Bearer token authentication is the simplest method - just pass your API key or token as a string.
mcp-use adds Authorization: Bearer <token> to every request automatically.
Quick Start
from mcp_use import MCPClient
config = {
"mcpServers": {
"api": {
"url": "https://api.example.com/mcp/sse",
"auth": "sk-your-api-key-here"
}
}
}
client = MCPClient(config=config)
When to Use
API Keys
Services that issue static API keys for authentication
Service Tokens
Machine-to-machine authentication between services
Personal Access Tokens
GitHub PATs, GitLab tokens, and similar credentials
Internal Services
Pre-shared secrets for private infrastructure
Secure Configuration
Environment Variables
python-dotenv
Multiple Servers
import os
config = {
"mcpServers": {
"api": {
"url": "https://api.example.com/mcp/sse",
"auth": os.getenv("MCP_API_KEY")
}
}
}
from dotenv import load_dotenv
import os
load_dotenv()
config = {
"mcpServers": {
"api": {
"url": os.getenv("MCP_SERVER_URL"),
"auth": os.getenv("MCP_API_KEY")
}
}
}
MCP_SERVER_URL=https://api.example.com/mcp/sse
MCP_API_KEY=sk-your-api-key-here
import os
config = {
"mcpServers": {
"service_a": {
"url": "https://service-a.example.com/mcp",
"auth": os.getenv("SERVICE_A_TOKEN")
},
"service_b": {
"url": "https://service-b.example.com/mcp",
"auth": os.getenv("SERVICE_B_TOKEN")
}
}
}
Never hardcode API keys in source code. Always use environment variables or a secrets manager.
Bearer vs OAuth
| Bearer Token | OAuth 2.1 |
|---|
| Setup | Simple | More complex |
| Token refresh | Manual | Automatic |
| User consent | Not required | Required |
| Token lifetime | Long-lived | Short-lived + refresh |
| Best for | API keys, services | User authentication |
If your token expires frequently or requires user authorization, consider using OAuth 2.1 instead. Security Checklist
Use environment variables
Never commit tokens to version control. Use .env files locally and secrets management in production.
Rotate tokens regularly
Implement a rotation policy to limit exposure from compromised tokens.
Use minimal permissions
If the service supports scoped tokens, request only what you need.
Monitor usage
Enable logging to detect unauthorized access attempts.
