What Are Access Keys For?

Access Keys exist to stop your MCP server from being publicly callable by anyone who finds its URL. By default, a server with no key configured is open to any client that knows the address — an Access Key closes that door for clients that don't use OAuth.

They're the simplest protection option: no external identity provider, no consent screen, just a value the client includes with every request. For clients that support OAuth instead, see OAuth Client.

Learn more: How to Protect a Server with an Access Key.