MCP authentication and transport: a setup guide

Decide where the server runs

The current MCP transport specification defines stdio for a client-launched subprocess and Streamable HTTP for a network endpoint. A local package needs an execution environment; a hosted server needs a reachable endpoint. Neither choice tells you which provider account is authorized.

Check the versions supported by both sides. Older SSE examples may describe a different transport revision. Use the publisher’s current client-specific instructions rather than changing “sse” to “http” in an old configuration and assuming compatibility.

Separate MCP authorization from downstream credentials

The MCP authorization specification covers HTTP-based authorization. Local processes commonly obtain provider credentials from their environment. A hosted server may use browser OAuth or document a specific API-key mechanism; the mere presence of an HTTPS URL does not establish which.

Record the credential audience and scope. An MCP access token and a downstream provider API key may serve different purposes. Do not forward an arbitrary credential to a new endpoint merely because a connection wizard accepts an Authorization field.

Two publisher examples show why setup varies

Appwrite documents a hosted endpoint with browser authorization. Parallel documents an anonymous Search endpoint, while its Task server requires an authenticated account and billable usage. These are useful examples of why a single “API key required” flag is insufficient.

Test the connection in layers

First verify that the intended client can reach or launch the server. Next complete authorization, list the available tools and perform one bounded read. Check the selected account and region before investigating a missing resource.

Keep secrets in the client’s supported credential mechanism or a server-side secret store. Do not put a real key into an installation link, analytics event or screenshot. When access is revoked, invalidate the stored credential and make the disconnected state visible. Record each test result separately so a transport failure is not reported as unsupported API functionality.