> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prophia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Access

> Connect to the MCP server headlessly with an API key

If your MCP client can't drive a browser OAuth login — CI jobs, server-side agents, or clients without OAuth support — connect with an **API key** instead.

For most organizations [OAuth](https://docs.prophia.com/developers/mcp/oauth-setup.md) is the better default: users sign in with credentials they already have, each person's own Prophia permissions apply, and there is no long-lived secret to distribute or rotate.

## Step 1 — Get a key

| Key type | Access level | How to get one |
| - | - | - |
| **Account API key** | The REST API and MCP permissions chosen when it was created, whoever is using it | Self-serve. An admin creates it in **Account Settings → API/MCP Config → Authorization Options → Account Tokens**. Keep at least one MCP permission selected. |
| **User API key** | The access that user has in Prophia, or less | Self-serve. Create it in **Account Settings → API/MCP Config → Authorization Options → User tokens**, and keep at least one MCP permission selected. |

See [Authentication](https://docs.prophia.com/developers/authentication.md) for key handling guidance — the same keys and precautions apply across the REST API and MCP.

> [!NOTE]
>
> Claude **Desktop** does not support API-key headers for this type of MCP server — use [OAuth](https://docs.prophia.com/developers/mcp/connect-claude.md) there. Claude **Code** and most configurable clients support headers.

## Step 2 — Configure the client

### Claude Code

```bash theme={null}
claude mcp add prophia \
  --transport http \
  --header "Authorization: Bearer {your-api-key}" \
  https://api.prophia.com/mcp/v1/{your-api-name}
```

### Cursor / other clients

Set these in your client's MCP configuration:

* **URL**: `https://api.prophia.com/mcp/v1/{your-api-name}`
* **Transport**: Streamable HTTP
* **Header**: `Authorization: Bearer {your-api-key}` (an `X-API-Key: {your-api-key}` header also works)

## Verify from the command line

A quick smoke test that your key and API Name are right — list the server's tools:

```bash theme={null}
curl -s https://api.prophia.com/mcp/v1/{your-api-name} \
  -H "Authorization: Bearer {your-api-key}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

A successful response returns a JSON list of tools. A `401` means the key is wrong, revoked, or — for a user key — missing the `MCP` scope. *Not found* usually means the API Name doesn't match.

## Security tips

* API keys grant access to your Prophia data — treat them like passwords
* Use a unique key per application, and revoke keys you no longer use
* Prefer user keys (least privilege) over account keys where possible — an account key isn't limited by any user's permissions, whoever is holding it
* Give each key only the permissions its client needs


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.