API keys and authentication

Create a free account. In the dashboard, open API keys and generate a key. It is shown only once, so copy it straight into your client configuration. Compromised keys can be revoked there at any time.

The server accepts the key in two equivalent forms:

X-CovaSyn-Key: <your-key>
Authorization: Bearer <your-key>

You can verify the key directly with curl:

curl -X POST https://mcp.covasyn.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'X-CovaSyn-Key: <your-key>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{
        "protocolVersion":"2025-06-18","capabilities":{},
        "clientInfo":{"name":"curl","version":"1.0"}}}'

If you get a response with serverInfo instead of an auth_error, the key works. Tool calls (tools/call) follow this initialisation; your client handles that.

Alternatively, the server speaks OAuth 2.1 with PKCE and dynamic client registration. MCP clients with OAuth support connect without manual key entry.

To the MCP docs