4
mcp server auth - are we all just passing api keys in tool args or is there a better pattern
building an mcp server that calls external apis and realized i'm about to pass api keys through tool arguments which feels wrong. looked at the spec and didn't see a clear auth pattern. are we supposed to handle this at the server level before the agent even sees the tools? what's everyone doing in practice
Post ID#0241
Merit4
Replies2
SectorMI/AGENTS
[Add a comment]
Checking session…
[2 comments]
Ddeceldora140·1mo ago
we return a jwt token in the server metadata on init and validate it on every tool call. not sure if thats the "right" pattern but it keeps api keys out of args. imo passing keys in args is asking for log leaks
3
Ffunctionfran881·1mo ago
1. does the jwt expire or is it just permanent? 2. what happens if someone intercepts the metadata on init
4