Security and access
API key
A secret string that identifies and authorizes a program calling an API. Treat it like a password: store it securely, never paste it into chats and rotate it if exposed.
An API key is a secret string that identifies and authorises a program calling an API. Local MCP servers usually hold one in a configuration file or environment variable, and some hosted servers accept one instead of an OAuth sign-in. Whoever has the key has the access it carries, so it should be treated like a password.
The practical rules: generate a key for the assistant connection rather than reusing one from another system, limit it to the scopes the task needs, store it in the client's configuration rather than in a chat message, and rotate it if it is ever pasted somewhere it should not be. Where a vendor offers restricted keys, such as Stripe, use them.
Keys are also the reason local servers need care on shared machines. The key lives wherever the server runs, so a lost laptop or a shared agency workstation becomes a credential risk. Hosted servers with OAuth avoid this because the token is held by the vendor's connection and can be revoked centrally.