Skip to main content
An API key is a static credential set once on an MCP server or API on the instance. The gateway adds it to every request it sends there. The agent never sends or receives it.

​
Key Types

The server’s auth sets the type, and value holds the key itself:
header sends the key in a header of another name in place of Authorization or X-API-Key. An API added as tools receives an api_key as both X-API-Key: <key> and Authorization: ApiKey <key>.

​
Static Headers

Static headers go to the server on every request, alongside the key. A static header replaces any header of the same name from another source.

​
Per-User Keys

A server can take one key per user Preview instead of one key for everyone. Each user stores a key once, and the gateway sends it on that user’s requests in the server’s key format, such as Authorization: Bearer <key>.

​
Storage

The gateway encrypts every credential it stores, including OAuth client secrets and users’ tokens. No response returns them, including to the account that stored them, and a server shows only its auth.type.