Authentication

Add your key to the MCP config

VerveContext authenticates with a scoped key placed once in your MCP client config — not sent on every request you write. Keys are prefixed vc_live_ and go in the headers block; your client forwards them with each MCP call automatically.

{
  "mcpServers": {
    "vervecontext": {
      "url": "https://api.vervecontext.com/v1/mcp",
      "headers": { "x-api-key": "vc_live_your_key" }
    }
  }
}

Scoped keys & least privilege

Scope each key to just the sources a given agent should reach, so a single agent can never call more than it needs. Every call is logged per source for audit, and you can rotate or revoke any key from the dashboard.

Security Best Practices

• Keep vc_live_ keys server-side — in a secrets manager, never committed with a live value
• Scope narrowly — one least-privilege key per agent beats one broad key everywhere
• Rotate if exposed — revoke and reissue immediately from the dashboard
• Review the audit log — per-source usage makes an unexpected call easy to spot