API Key Access

If your MCP client can’t drive a browser OAuth login — CI jobs, server-side agents, or clients without OAuth support — connect with an API key instead. For most organizations OAuth is the better default: users sign in with credentials they already have, each person’s own Prophia permissions apply, and there is no long-lived secret to distribute or rotate.

Step 1 — Get a key

Key type	Access level	How to get one
Account API key	The REST API and MCP permissions chosen when it was created, whoever is using it	Self-serve. An admin creates it in Account Settings → API/MCP Config → Authorization Options → Account Tokens. Keep at least one MCP permission selected.
User API key	The access that user has in Prophia, or less	Self-serve. Create it in Account Settings → API/MCP Config → Authorization Options → User tokens, and keep at least one MCP permission selected.

See Authentication for key handling guidance — the same keys and precautions apply across the REST API and MCP.

Claude Desktop does not support API-key headers for this type of MCP server — use OAuth there. Claude Code and most configurable clients support headers.

Step 2 — Configure the client

Claude Code

claude mcp add prophia \
  --transport http \
  --header "Authorization: Bearer {your-api-key}" \
  https://api.prophia.com/mcp/v1/{your-api-name}

Cursor / other clients

Set these in your client’s MCP configuration:

URL: https://api.prophia.com/mcp/v1/{your-api-name}
Transport: Streamable HTTP
Header: Authorization: Bearer {your-api-key} (an X-API-Key: {your-api-key} header also works)

Verify from the command line

A quick smoke test that your key and API Name are right — list the server’s tools:

curl -s https://api.prophia.com/mcp/v1/{your-api-name} \
  -H "Authorization: Bearer {your-api-key}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A successful response returns a JSON list of tools. A 401 means the key is wrong, revoked, or — for a user key — missing the MCP scope. Not found usually means the API Name doesn’t match.

Security tips

API keys grant access to your Prophia data — treat them like passwords
Use a unique key per application, and revoke keys you no longer use
Prefer user keys (least privilege) over account keys where possible — an account key isn’t limited by any user’s permissions, whoever is holding it
Give each key only the permissions its client needs

Getting Started

Prophia MCP Server

Docs MCP Server

Step 1 — Get a key

Step 2 — Configure the client

Claude Code

Cursor / other clients

Verify from the command line

Security tips