Guide

Authentication

Understand MCP Ops keys and upstream API credentials.

MCP Ops API keys

Hosted MCP endpoints require a project-scoped bearer key. Keys can be named, expired, and revoked independently without redeploying the runtime.

Upstream credentials

If the source API requires authentication, store its credential in the workspace and attach it to the deployment. Credential values are not written into generated definitions or returned to the browser.

Request format

Send Authorization: Bearer <key> with each POST request to /mcp. Invalid endpoint and credential combinations return the same response to avoid leaking deployment existence.

Ready to put this into practice?Open MCP Ops