Skip to content
Forktime Developers

Book MCP — authentication

The Book MCP is a cross-venue booking surface — it isn’t tied to any one restaurant. But unlike an anonymous public API, it’s gated by a developer key so every search and booking is attributable, rate-limited, and revocable.

Connecting

Section titled “Connecting”

Point an MCP client at the endpoint and send your developer key as a bearer token:

https://api.forktime.ai/booking/mcp
Authorization: Bearer gfk_dev_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

No brand context, no X-Brand-Slug — a developer key isn’t tied to a restaurant. You discover venues with search_venues and address them by the slug it returns.

Getting a developer key

Section titled “Getting a developer key”

Developer keys are separate from the owner gfk_live_ API keys — they can only search and book, never manage a restaurant.

  1. Sign in at app.forktime.ai.
  2. Open Developer keys and create one. The gfk_dev_… secret is shown once — copy it then.
  3. Send it as Authorization: Bearer <key> on every request.

A developer key carries exactly three scopes — booking.search, booking.availability, booking.create — and nothing else. It can’t reach the Manage MCP, and an owner key can’t reach this one.

Rate limiting

Section titled “Rate limiting”

Limits are enforced per key, not per IP — search and availability are cheap, booking is tightly capped:

Tool Limit
search_venues 30 / min
get_availability 20 / min
book 10 / min

Building a high-volume integration? Ask about a partner key for higher limits and attribution.

What protects a booking

Section titled “What protects a booking”

Beyond the key, a booking is protected by its own design:

  • book requires the guest’s real phone. The confirmation + the manage link are texted there, so a booking can only be reached by whoever holds that phone.
  • The MCP can’t edit or cancel. Even the assistant that created a booking can’t change it — only the guest can, via the SMS link.
  • Every call is attributed to your key. Abuse is traceable and the key can be disabled instantly.

Guest data

Section titled “Guest data”

You send the guest’s name, phone, and (optionally) email to book. That’s the only personal data the Book MCP handles — used to create the reservation and send the manage link. It never reads a restaurant’s guest book or history.