secure.mcp.acme-corp.ai - the API-key copy of the MCP endpoints. POST /mcp or /<domain>/mcp with an Authorization: Bearer <key> header. The index page, the manifest bundle and everything else live at https://mcp.acme-corp.ai/ and need no key.