Correct MCP authentication docs: OAuth-only, PATs for REST API

[cursor]

Problem

The published MCP introduction currently says a Personal Access Token can authenticate both the REST API and the MCP endpoint. That is not the supported product contract.

Supported authentication:

• MCP (/mcp/trypost): OAuth 2.1 only, using Dynamic Client Registration, PKCE, and the mcp:use scope.
• REST API (/api/*): Personal Access Token/API key only, sent as Authorization: Bearer YOUR_API_TOKEN.

Documentation to update

• Remove the Personal Access Token fallback for MCP from the Authentication section.
• Remove or rewrite MCP troubleshooting text that recommends a PAT when OAuth/browser authorization is unavailable.
• Make clear that API keys are exclusively for REST API requests.
• Check all MCP client guides for the same fallback language.

Affected page: https://docs.trypost.it/ai/introduction

Acceptance criteria

• No documentation claims that PATs work with the MCP endpoint.
• MCP authentication is documented as OAuth-only.
• REST API authentication is documented as PAT/API-key Bearer authentication.