SYSTEM ACTIVE
m mcpmeter
Sign up
Sign up Sign in
HOME / DOCS / AUTHENTICATION
DOCS NAV · AUTHENTICATION ▾
GET STARTED
Quickstart Concepts
INTEGRATIONS
Clients & code samples
META
Changelog
DOC CORE

AUTHENTICATION

Bearer keys, key rotation, revocation, and what gets stored where.

v0.1.0 UPDATED 2026-05-09 ~4 MIN READ

BEARER KEYS

Every request to the proxy carries a single bearer token in the Authorization header:

HTTP requestHEADER
Authorization: Bearer mcpm_live_a8f3c4e9b2d1a7c6f4e8b3d9c2a1e7f0

That's it. No OAuth, no signed requests, no client credentials — the bearer token is the entire authentication story. This matches how every MCP-compatible client expects to authenticate against an HTTP MCP server.

KEY FORMAT

Keys have three parts — you only ever interact with the full string:

PARTEXAMPLEPURPOSE
mcpm_mcpm_Fixed prefix. Helps secret scanners spot leaked keys.
envlive_Always live_ today. Reserved for a future test_ sandbox.
secreta8f3c4…f032 hex chars of CSPRNG output. The actual secret.

The first 12 characters (the prefix) are stored in plaintext for display in dashboards (mcpm_live_a8…). The full secret is hashed with SHA-256 at write time; we cannot recover or display it after generation.

SHOWN ONCE

The full secret is shown once, on the page where you generate the key. Copy it then. If you lose it, you must revoke and regenerate — we genuinely cannot recover what was generated.

SHA-256 in. Plaintext out only at generation. Lost → rotate, never recover.

GENERATE A KEY

From the dashboard, open Keys and click Generate. Best practice is one key per agent (or environment), so you can revoke them independently:

  • Cursor · production
  • Cursor · dev laptop
  • Claude Desktop · personal
  • CI integration tests

All keys debit the same global credit balance. Per-key spend caps live on projects: each key is bound to exactly one project, and the project carries the cap.

ROTATING A KEY

Two-step process to avoid downtime:

  1. Generate a new key with the same project binding.
  2. Deploy the new key to your agent's config; restart.
  3. Revoke the old key. Calls with the revoked key now return 401 immediately.

REVOKING A KEY

Click Revoke next to a key on the Keys page. Effective immediately: the proxy's auth cache TTL is 60 seconds, so any in-flight call may still succeed for up to a minute, but no new calls will authenticate after that window.

Revoked keys stay in the database for audit (you can see when they were last used). They cannot be un-revoked — generate a fresh key instead.

UNAUTHENTICATED RESPONSES

STATUSCONDITION
401Missing Authorization header.
401Header present but token doesn't match any key.
401Token matches a revoked key.
401Token's owner has been suspended.

Every 401 response includes a WWW-Authenticate: Bearer header per RFC 6750.

WHERE KEYS GO

Three places only:

  • Your agent's local MCP config file. Treat this like any production secret.
  • Your dev laptop's keychain or password manager (whatever the agent reads from).
  • For CI: a GitHub Actions secret, AWS SSM parameter, GCP Secret Manager, etc.
DO NOT COMMIT

The mcpm_ prefix means GitHub's secret scanner catches leaks — but you should rotate immediately if a key reaches a public repo. Don't rely on the scanner; treat keys like any production secret.