Repository navigation
API keys in the URL? #1665
Replies: 2 comments 1 reply
|
I am not a security expert! However, my understanding is that sensitive information such as API keys should not be put in URLs, regardless of MCP. Here is an advisory from OWASP (though it pertains to REST APIs):
|
|
Thanks, yeah I knew it is a bad idea but I was curious if this was officially documented anywhere MCP-related. I've seen some MCP servers in the wild that expect an API key in the URL, such as Tavily: https://docs.tavily.com/documentation/mcp#remote-mcp-server |
|
There is an MCP-specific reference for the bearer-token case. In the MCP authorization spec, the "Access Token Usage" section says clients must send access tokens with the Authorization: Bearer <access-token>It also says: That wording is technically about OAuth access tokens rather than every possible API key scheme, but I think it gives the MCP-native answer for remote servers: credentials should travel in auth headers, not in the connection URL. The usual non-MCP reasons still apply too: URLs tend to show up in logs, browser history, proxies, analytics, and error reports. |
Uh oh!
There was an error while loading. Please reload this page.
Is it officially documented anywhere that expecting an API key in the connection URL for remote servers (i.e.
https://mcp.example.com/connect/<api key>) is a bad practice? I'm looking for references to this in the documentation but I can't find anything.All reactions