Bearer Token

Bearer token authentication is the simplest method - just pass your API key or token as a string.

mcp-use adds Authorization: Bearer <token> to every request automatically.

Quick Start

from mcp_use import MCPClient

config = {
    "mcpServers": {
        "api": {
            "url": "https://api.example.com/mcp/sse",
            "auth": "sk-your-api-key-here"
        }
    }
}

client = MCPClient(config=config)

When to Use

API Keys

Services that issue static API keys for authentication

Service Tokens

Machine-to-machine authentication between services

Personal Access Tokens

GitHub PATs, GitLab tokens, and similar credentials

Internal Services

Pre-shared secrets for private infrastructure

Secure Configuration

Environment Variables
python-dotenv
Multiple Servers

import os

config = {
    "mcpServers": {
        "api": {
            "url": "https://api.example.com/mcp/sse",
            "auth": os.getenv("MCP_API_KEY")
        }
    }
}

from dotenv import load_dotenv
import os

load_dotenv()

config = {
    "mcpServers": {
        "api": {
            "url": os.getenv("MCP_SERVER_URL"),
            "auth": os.getenv("MCP_API_KEY")
        }
    }
}

.env file:

MCP_SERVER_URL=https://api.example.com/mcp/sse
MCP_API_KEY=sk-your-api-key-here

import os

config = {
    "mcpServers": {
        "service_a": {
            "url": "https://service-a.example.com/mcp",
            "auth": os.getenv("SERVICE_A_TOKEN")
        },
        "service_b": {
            "url": "https://service-b.example.com/mcp",
            "auth": os.getenv("SERVICE_B_TOKEN")
        }
    }
}

Never hardcode API keys in source code. Always use environment variables or a secrets manager.

Bearer vs OAuth

	Bearer Token	OAuth 2.1
Setup	Simple	More complex
Token refresh	Manual	Automatic
User consent	Not required	Required
Token lifetime	Long-lived	Short-lived + refresh
Best for	API keys, services	User authentication

If your token expires frequently or requires user authorization, consider using OAuth 2.1 instead.

Security Checklist

Use environment variables

Never commit tokens to version control. Use .env files locally and secrets management in production.

Rotate tokens regularly

Implement a rotation policy to limit exposure from compromised tokens.

Use minimal permissions

If the service supports scoped tokens, request only what you need.

Monitor usage

Enable logging to detect unauthorized access attempts.

Get Started

MCP Server

MCP Client

MCP Agents

Development

Quick Start

When to Use

API Keys

Service Tokens

Personal Access Tokens

Internal Services

Secure Configuration

Bearer vs OAuth

Security Checklist

​Quick Start

​When to Use

API Keys

Service Tokens

Personal Access Tokens

Internal Services

​Secure Configuration

​Bearer vs OAuth

​Security Checklist

Quick Start

When to Use

Secure Configuration

Bearer vs OAuth

Security Checklist