en How to Protect a Server with an Access Key

How to Protect a Server with an Access Key

By default, a server with no key configured is publicly reachable by anyone who knows its URL. An Access Key closes that door for clients that don't use OAuth.

Steps

1. Open the server's Connect tab.

   Open the capture server to document Protect a Server with an Access Key.

   

2. Under Access Keys, click "Add key" and name it after the client that will use it (for example, "Claude Desktop" or "Cursor"). You can create as many named keys as you need — one per client is a good default, since it lets you revoke one client's access without affecting the others.

   Open the Connect tab, which contains the interface used by this procedure.

   

3. Copy the generated key value and store it somewhere safe. It's masked by default in the list, but you can reveal it again anytime with the eye icon.

4. Give the key to the client. It should send it as the auth header (preferred) or, if headers aren't available, the ?auth= query parameter.

   Bring the Access Keys panel into the screenshot viewport.

   

Confirm it worked

A request without a valid key is rejected; the same request with the key succeeds.

To revoke a key

Click the trash icon next to the key and confirm. This permanently deletes the key — it's not a soft-revoke you can undo, so any client still using it will need a new key.

Good to know

• Prefer the header over the query parameter — query strings can end up in browser history and infrastructure logs.
• Need OAuth instead of a static key? See How to Connect ChatGPT via OAuth.

Related

• Secrets and Authentication
• How to Connect Claude Desktop
• How to Connect Cursor