diff --git a/src/api/auth.py b/src/api/auth.py
index c657eda..ca0c609 100644
--- a/src/api/auth.py
+++ b/src/api/auth.py
@@ -16,7 +16,6 @@ def _abort_401(message: str):
 def require_token(fn):
     @wraps(fn)
     def wrapper(*args, **kwargs):
-        print(API_AUTH_DISABLED)
         if not API_AUTH_DISABLED:
             header = request.headers.get("Authorization", "")
             if not header.startswith("Bearer "):
@@ -30,6 +29,9 @@ def require_token(fn):
                 _abort_401("invalid_token")
             if row["revoked_at"] is not None:
                 _abort_401("revoked_token")
+            if row["kind"] == "mcp":
+                # jeton dédié MCP : non valable sur l'API REST
+                _abort_401("invalid_token")
             g.token_id = row["id"]
         return fn(*args, **kwargs)
 
diff --git a/tests/api/test_auth.py b/tests/api/test_auth.py
index 7b97fbd..9618e9e 100644
--- a/tests/api/test_auth.py
+++ b/tests/api/test_auth.py
@@ -57,3 +57,22 @@ def test_valid_token_sets_g_and_calls_view(temp_db):
     )
     assert resp.status_code == 200
     assert resp.get_json()["token_id"] == token_id
+
+
+def test_mcp_kind_token_rejected_by_rest_api(temp_db):
+    token, _ = tokens_db.create_token(temp_db, "x", user_id=1, kind="mcp")
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "invalid_token"
+
+
+def test_api_kind_token_accepted_by_rest_api(temp_db):
+    token, _ = tokens_db.create_token(temp_db, "x", kind="api")
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 200