Authentication

The Sazabi MCP server requires a secret API key for authentication. This key is passed in a header with each request to the MCP server.

Getting a secret key

Key types

Sazabi offers two types of API keys:

For MCP server authentication, you must use a Secret key. Public keys do not have the permissions required for the MCP server's tools.

Using the key

When configuring your MCP client, the secret key is typically passed as an environment variable or header:

Header name

X-Sazabi-Secret-Key

Example configuration

Most MCP clients use the @anthropic-ai/mcp-remote package, which accepts headers via environment variables prefixed with HEADER_:

{
  "env": {
    "HEADER_X_SAZABI_SECRET_KEY": "sk_your_secret_key_here"
  }
}

See the client setup guides for specific configuration instructions for each AI tool.

Security best practices

Keep keys secure

• Never commit secret keys to version control
• Do not share keys in chat or email
• Use environment variables instead of hardcoding keys
• Rotate keys periodically

Limit key scope

• Create separate keys for different tools or team members
• Use descriptive names to track key usage
• Revoke keys when they are no longer needed

Monitor key usage

• Check the API Keys page for last-used timestamps
• Revoke keys that show unexpected activity
• Rotate keys if you suspect they have been compromised

Revoking a key

If a key is compromised or no longer needed:

Revoking a key is immediate. Any MCP clients using that key will immediately lose access.

Troubleshooting

Authentication errors

If you see authentication errors when connecting:

1. Verify the key is correct and has not been revoked.
2. Check that the header name is exactly X-Sazabi-Secret-Key.
3. Ensure you are using a Secret key, not a Public key.
4. Verify the environment variable name matches your client's expected format.

Key not working after rotation

If you rotated a key and the new one is not working:

1. Restart your MCP client after updating the configuration.
2. Verify the new key was copied correctly.
3. Check that you updated all locations where the key is used.

Next steps