- Clients use
https://www.affix-io.com/mcponly. - Authorisation is OAuth 2.0 PKCE in the browser.
- Do not put platform credentials in MCP client config, READMEs, or UI copy.
- Upstream Affix API credentials stay on the server.
- Never log, return, or document those values in user-facing surfaces.
zk_verify_userand HTTP health responses must not include key material.