How to connect the Apideck MCP server

Before you start

• An Apideck account with an application. The application gives you the API key and application ID. apideck.com/mcp-servergithub.com/apideck-libraries
• Connect the SaaS apps you want the agent to use (for example QuickBooks, Xero or BambooHR) in Vault for the consumer ID you send. apideck.com/mcp-server

Authentication

Your client → Apideck MCP

API key. apideck.com/mcp-servergithub.com/apideck-librariesregistry.modelcontextprotocol.io/v0.1

Apideck MCP → Apideck API

The server uses credentials the server manages. apideck.com/mcp-server

Steps

1. Open Apideck's MCP server setup instructions

   github.com/apideck-libraries/mcp
2. Add the Apideck MCP server to your client

   Add https://mcp.apideck.dev/mcp as a remote MCP server that uses the Streamable HTTP transport (often labelled "http"). Apideck also publishes a Claude Desktop bundle, one-click installs for Cursor and VS Code, and a local stdio package.

   github.com/apideck-librariesregistry.modelcontextprotocol.io/v0.1
3. Required: your Apideck API key (x-apideck-api-key header)
   github.com/apideck-librariesregistry.modelcontextprotocol.io/v0.1
4. Required: your Apideck application ID (x-apideck-app-id header)
   github.com/apideck-librariesregistry.modelcontextprotocol.io/v0.1
5. Your consumer ID, whose Vault connections the server uses (x-apideck-consumer-id header)
   github.com/apideck-librariesregistry.modelcontextprotocol.io/v0.1
6. If your client accepts only one credential, use a bearer token

   Send your API key as a bearer token in the Authorization header, and pass the application ID, consumer ID and service ID as the app_id, consumer_id and service_id query parameters on the server URL. The API key is never accepted in the URL.

   github.com/apideck-libraries
7. Optional: authenticate with a Vault session token instead of your API key

   Create a Vault session on your backend and send its session token as the bearer token, with the x-apideck-auth-type header set to JWT plus the x-apideck-app-id and x-apideck-consumer-id headers for that session's consumer. A session token can't create another Vault session, and if a connection needs re-authorizing the tool returns an error instead of a re-auth link. This works over HTTP only.

   github.com/apideck-librariesdevelopers.apideck.com/apis
8. List the server's tools

   Your client should list the server's tools. That confirms the connection, not every API permission.

   github.com/apideck-libraries

What we observed

• 5 Nov 2026: HTTP 200 (text/event-stream) to an initialize request without credentials; the server reported serverInfo apideck-mcp 0.28.0 and protocol version 2025-06-18. Credentials are not checked at initialize, so a successful initialize doesn't confirm the headers are valid.
• 5 Nov 2026: initialize and tools/list succeeded without credentials: 4 tools (list_tools, describe_tool_input, execute_tool, list_scopes). Tool execution needs the documented headers.