API keys and authentication

If an MCP server error sent you here: your request is missing a valid API key. Here is how to get one, free of charge.

Step 1: Create an account

Sign up at workspace.covasyn.com. Email and password are all it takes, no payment details. The free tier includes 100 analyses per week.

Step 2: Generate a key

In the dashboard, open API keys and generate a key. It is shown exactly once, copy it straight into your client configuration. Compromised keys can be revoked there at any time.

Step 3: Send the key

The server accepts the key in two equivalent forms:

X-CovaSyn-Key: <your-key>
Authorization: Bearer <your-key>

You can verify the key directly with curl:

curl -X POST https://mcp.covasyn.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'X-CovaSyn-Key: <your-key>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
        "name":"covabasic_canonicalize",
        "arguments":{"smiles":"CCO"}}}'

If you get a result instead of an auth_error, the key works.

OAuth

Alternatively, the server speaks OAuth 2.1 with PKCE and dynamic client registration. MCP clients with OAuth support connect without manual key entry. Details and discovery endpoints are in the MCP documentation.