> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> A static API key, bearer token, or password that the gateway sends to an MCP server or API on every request.

An API key is a static credential set once on an MCP server or API on the instance. The gateway adds it to every request it sends there. The agent never sends or receives it.

## Key Types

The server's `auth` sets the type, and `value` holds the key itself:

```json theme={null}
{
  "type": "api_key",
  "value": "example-orders-key"
}
```

| Type | What the Server Receives |
| - | - |
| `api_key` | `X-API-Key: <key>` |
| `bearer_token` | `Authorization: Bearer <token>` |
| `basic` | `Authorization: Basic <base64 of user:password>`, from a `value` of `user:password` |
| `token` | `Authorization: token <token>` |
| `authorization` | `Authorization: <value>`, exactly as stored |

`header` sends the key in a header of another name in place of `Authorization` or `X-API-Key`. An [API added as tools](https://developers.telnyx.com/docs/agent-gateway/targets/tools.md#apis) receives an `api_key` as both `X-API-Key: <key>` and `Authorization: ApiKey <key>`.

## Static Headers

Static headers go to the server on every request, alongside the key. A static header replaces any header of the same name from another source.

## Per-User Keys

A server can take one key per user Preview instead of one key for everyone. Each user stores a key once, and the gateway sends it on that user's requests in the server's key format, such as `Authorization: Bearer <key>`.

## Storage

The gateway encrypts every credential it stores, including OAuth client secrets and users' tokens. No response returns them, including to the account that stored them, and a server shows only its `auth.type`.