Skip to main content

​
How it works

In API Key mode, MCPCore checks every incoming request for a valid key in the X-API-Key header (Authorization: Bearer <key> is also accepted). Requests that omit the key or provide a key that does not belong to this server receive a 401 Unauthorized response before any tool code runs. MCPCore generates the key for you when you select this mode. Each key belongs to a single server. Only the server owner can view it in the dashboard. Regenerating the key from the Edit form revokes the previous key immediately.

​
When to use it

  • Internal tooling, you control all the clients and can distribute the key securely
  • Server-to-server integrations, your backend includes the key on every request
  • Team tools, share the key only with the clients that need it and regenerate it when someone leaves
  • Quick production lockdown, the simplest way to move a server off Public mode without setting up OAuth

​
Configure

1

Create or edit a server

Open the server creation form (New Server) or click Edit on an existing server.
2

Select API Key

Under Security Mode, select API Key.MCPCore automatically generates an API key and displays it in the form.
3

Copy the key

Copy the key and store it securely (a password manager, vault, or environment variable in your CI system).
4

Save

Click Save. The server now requires the X-API-Key header for all requests.

​
Client configuration

Include the key in the X-API-Key header:
The Integration tab on your server’s detail page generates these snippets with your actual key pre-filled.

​
Key management

From the server’s Overview section you can:
  • Generate additional keys (one per integration or environment)
  • Revoke individual keys without affecting others
  • Label keys so you know which integration uses each one
Revoking a key takes effect immediately. Clients using that key will receive 401 until they are reconfigured with a valid key.

​
Key rotation

To rotate a key without downtime:
  1. Generate a new key from the dashboard
  2. Update your client configurations with the new key
  3. Verify the clients are working
  4. Revoke the old key