How Do Access Keys Work?

An Access Key is a named credential that protects a server's MCP endpoint. A server can have multiple named keys — one per client is the usual pattern. A client sends its key as the auth header (preferred) or the ?auth= query parameter on every MCP request; requests without a valid key are rejected.

Keys are managed from the server's Connect tab: you create one with a name, copy its value, and revoke it later with a permanent delete — there's no soft-revoke or expiry.

Learn more: How to Protect a Server with an Access Key.