fix: stabilize post-MVP travel-agent and itinerary workflows

documentation/docs/configuration/advanced_configuration.md

@@ -9,4 +9,15 @@ In addition to the primary configuration variables listed above, there are sever
 | `SOCIALACCOUNT_ALLOW_SIGNUP` | No       | When set to `True`, signup will be allowed via social providers even if registration is disabled.                                                                                          | `False`       | Backend           |
 | `OSRM_BASE_URL`             | No       | Base URL of the OSRM routing server used for itinerary connector distance/travel-time metrics. The public OSRM demo server is used by default. Set this to point at your own OSRM instance (e.g. `http://osrm:5000`) for higher rate limits or offline use. When the OSRM server is unreachable, the backend automatically falls back to haversine-based approximations so the itinerary UI always shows metrics. | `https://router.project-osrm.org` | Backend           |
 | `FIELD_ENCRYPTION_KEY`      | No*      | Fernet key used to encrypt user API keys at rest (integrations API key storage). Generate a 32-byte urlsafe base64 key (e.g. `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`). If missing/invalid, only API-key storage endpoints fail gracefully and the rest of the app remains available. | _(none)_ | Backend |
-| `DJANGO_MCP_ENDPOINT`       | No       | HTTP path used for Django MCP server streamable endpoint.                                                                                                                                    | `api/mcp`     | Backend           |
+| `DJANGO_MCP_ENDPOINT`       | No       | HTTP path used for the Voyage Travel Agent MCP endpoint. Clients call this endpoint with `Authorization: Token <token>` using a DRF auth token for the target user account.                                                        | `api/mcp`     | Backend           |
+
+## MCP endpoint authentication details
+
+Voyage's MCP endpoint requires token authentication.
+
+- Header format: `Authorization: Token <token>`
+- Default endpoint path: `api/mcp`
+- Override path with: `DJANGO_MCP_ENDPOINT`
+- Token bootstrap endpoint for authenticated sessions: `GET /auth/mcp-token/`
+
+For MCP usage patterns and tool-level examples, see the [Travel Agent (MCP) guide](../guides/travel_agent.md).