> For the complete documentation index, see [llms.txt](https://mcp-docs.nichefire.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mcp-docs.nichefire.com/quick-start/authentication/authentication-through-api-key.md).

# Authentication through API Key

API key authentication sends a credential with every request to the Nichefire MCP server. It is suitable for scripts, custom agents, self-hosted integrations, and AI clients that support custom HTTP headers.

{% hint style="info" %}
If your client supports OAuth-based connectors  ( such as a ChatGPT App or a Claude plugin), OAuth may provide a simpler alternative because it does not require storing an API key.
{% endhint %}

### How it works

Include the following header with every request:

```
x-api-key: <YOUR_API_KEY>
```

No interactive login, token exchange, or persistent session is required. Each request is authenticated independently using the supplied API key.

{% hint style="info" %}
In an AI client, configure the header in the connector’s custom-header settings when adding the server. In a custom integration, include it with every HTTP request sent to the MCP endpoint.
{% endhint %}

### Getting a key

API keys are issued by your Nichefire representative. To request one, follow the instructions in [**Environments & Access**](/overview/environments-and-access.md).

### Example

```sh
curl -sS https://mcp-sandbox.nichefire.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'x-api-key: <YOUR_API_KEY>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```

A successful response lists the tools available to the API key. This provides a quick way to verify that the key is valid and confirm which capability families are enabled for your organization.

The `accept` header must permit both supported response types:

```
accept: application/json, text/event-stream
```

The server may respond using either format. Omitting one of these media types is a common cause of failed requests in an otherwise valid configuration.

### Protecting Your API Key

{% hint style="danger" %}
The API key provides access to your organization’s Nichefire data and consumes its shared usage allowance.

Follow these requirements when handling it:

* Store the key in your client’s designated credential field or an approved secrets manager.
* Do not place it in source control, shared documents, support tickets, logs, or other unsecured locations.
* Do not embed it in browser-side or mobile application code, where it could be extracted by users.
* Do not share the key outside your organization or with users who do not require access.

If the key is exposed or suspected to be compromised, contact your Nichefire representative to have it rotated.
{% endhint %}

### Troubleshooting

| Error                      | Most Probable Reason                                                                                                                                                                                     |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Missing x-api-key header` | The client did not send the header. Check the connector's custom-headers configuration — some clients require you to save the connector before headers take effect.                                      |
| `Invalid API Key`          | The key is wrong, disabled, or issued for a different environment or a different Nichefire product.                                                                                                      |
| `Rate limit exceeded`      | Your organization has used its allowance for the current window, or exhausted its quota. Ask your assistant to check usage, or [contact](/help-and-support/contact-us.md) your Nichefire representative. |
| Fewer tools than expected  | Your organization is not entitled to those capability families. See [Capabilities](/overview/capabilities.md).                                                                                           |

Once you have gathered your API Key and are ready to setup an integration, continue to [Supported Integrations](/quick-start/supported-integrations.md).