payloadcms.com
Payload is a code-first headless CMS and application framework that installs into a Next.js app and generates APIs from your collection and global configuration. It supports local server-side data access, REST and GraphQL endpoints, authentication features, and optional plugins such as MCP.
Payload exposes tenant-hosted REST and GraphQL APIs, an installable MCP server plugin, and a project-local CLI; REST and GraphQL support JWT or user API key auth, MCP uses plugin-issued API keys, and the CLI itself is unauthenticated.
- Payload MCP serverdiscovered
- Payload REST APIdiscovered
- Payload GraphQL APIdiscovered
- Payload CLIdiscovered
Enable auth on a Payload collection, then authenticate a user via the collection's login operation as described in Authentication Operations. The response includes a token you can send as Authorization: JWT <token> per JWT Strategy.
Enable auth.useAPIKey: true on an auth collection, then in the Payload Admin UI generate an API key for a user in that collection, as documented in API Key Strategy. Requests send it in Authorization using the format `<collection-slug> API-Key <apiKey>`.
Install and configure the MCP plugin, then in the Payload admin panel go to MCP -> API Keys, create a key, and enable the desired capabilities for collections, globals, tools, prompts, and resources as described in MCP Plugin.
conventions · 1/8 published
- integrations.json✗
/.well-known/integrations.json - llms.txt✓https://payloadcms.com/llms.txt
- API catalog✗
/.well-known/api-catalog - OpenAPI document✗
/api/schema/, /openapi.json, /swagger.json, /api/openapi.json, or /v1/openapi.json - MCP server card✗
/.well-known/mcp/server-card.json - OAuth protected resource✗
/.well-known/oauth-protected-resource - Agent card✗
/.well-known/agent-card.json - Agent skills✗
/.well-known/agent-skills/index.json
Publish these signals → /publishing