Skip to main content

​
The four security modes

Security is configured per-server, not per-account. You can run a public demo server and a production API-Key-locked server at the same time.

​
Choosing the right mode

​
Public

No authentication required. Anyone with the endpoint URL can call your tools. Use for open demos or tools that only read publicly available data. Configure Public mode →

​
API Key

Clients include a per-server key in the X-API-Key header:
The key is generated by MCPCore and displayed once at creation. It remains valid until you explicitly revoke it. You can create multiple keys, one per integration or team member, and revoke them individually. Use for internal tools and server-to-server integrations where you control the clients. Configure API Key mode →

​
OAuth 2.0

Clients authenticate through a standard OAuth 2.0 authorization flow. You supply your Authorization Server’s RFC 8414 metadata URL (the .well-known endpoint from Okta, Auth0, Keycloak, Azure AD/Entra ID, or your own server). MCPCore validates the metadata, sets up discovery endpoints for your subdomain, and verifies incoming JWTs using your server’s public keys, checking that the token’s audience matches your MCPCore resource exactly (RFC 8707). MCP clients register themselves and complete the OAuth flow automatically. Use for user-facing applications where tools act on behalf of individual users, or wherever you want to reuse an existing enterprise identity provider. Configure OAuth 2.0 mode → Enterprise SSO provider guides (Auth0, Okta, Keycloak, Azure AD/Entra ID) →

​
Bearer Token

Clients include a signed JWT in the Authorization header:
The token is generated by MCPCore and displayed once at creation. Bearer Token mode gives you finer control over token expiry and scope than API Key mode, without setting up a full OAuth flow. Use when you want signed, revocable tokens for automation or CI/CD pipelines. Configure Bearer Token mode →

​
Changing the security mode

Switch modes at any time from the server’s Edit form. The subdomain URL stays the same.
Mode changes take effect immediately. Connected clients that no longer provide valid credentials will receive 401 Unauthorized.

​
Security does not affect tool code

Your tool code always receives the same params and env objects regardless of the security mode. Authentication is handled entirely at the server layer before your code runs.