API keys and authentication

If an MCP server error sent you here: your request is missing a valid API key. Here is how to get one.

Step 1: Book an intro call

Book a no-strings intro call. 15 minutes by phone, we work out access and use case and set up your API key.

Step 2: Generate a key

In the dashboard, open API keys and generate a key. It is shown exactly once, copy it straight into your client configuration. Compromised keys can be revoked there at any time.

Step 3: Send the key

The server accepts the key in two equivalent forms:

X-CovaSyn-Key: <your-key>
Authorization: Bearer <your-key>

You can verify the key directly with curl:

curl -X POST https://mcp.covasyn.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'X-CovaSyn-Key: <your-key>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
        "name":"covabasic_canonicalize",
        "arguments":{"smiles":"CCO"}}}'

If you get a result instead of an auth_error, the key works.

OAuth

Alternatively, the server speaks OAuth 2.1 with PKCE and dynamic client registration. MCP clients with OAuth support connect without manual key entry. Details and discovery endpoints are in the MCP documentation.