Skip to main content

​
How it works

In API Key mode, MCPCore checks every incoming request for a valid X-API-Key header. Requests that omit the header or provide an unrecognised key receive a 401 Unauthorized response before any tool code runs. MCPCore generates the key for you when you select this mode. The key is shown once at creation, so store it securely. It remains valid until you explicitly revoke it. You can create multiple keys, one per integration, team member, or client, and revoke them individually without affecting the others.

​
When to use it

  • Internal tooling, you control all the clients and can distribute the key securely
  • Server-to-server integrations, your backend includes the key on every request
  • Team tools, issue one key per team or one key per integration and revoke per-client when needed
  • Quick production lockdown, the simplest way to move a server off Public mode without setting up OAuth

​
Configure

1

Create or edit a server

Open the server creation form (New Server) or click Edit on an existing server.
2

Select API Key

Under Security Mode, select API Key.MCPCore automatically generates an API key and displays it in the form.
3

Copy the key

Copy the key immediately, it is shown only once. Store it securely (a password manager, vault, or environment variable in your CI system).
4

Save

Click Save. The server now requires the X-API-Key header for all requests.

​
Client configuration

Include the key in the X-API-Key header:
The Integration tab on your server’s detail page generates these snippets with your actual key pre-filled.

​
Key management

From the server’s Overview section you can:
  • Generate additional keys (one per integration or environment)
  • Revoke individual keys without affecting others
  • Label keys so you know which integration uses each one
Revoking a key takes effect immediately. Clients using that key will receive 401 until they are reconfigured with a valid key.

​
Key rotation

To rotate a key without downtime:
  1. Generate a new key from the dashboard
  2. Update your client configurations with the new key
  3. Verify the clients are working
  4. Revoke the old key