Authentication

Interactive hosted MCP clients use OAuth discovery and browser consent. REST, CLI, the TypeScript adapter, and headless MCP agents use a Hive API key. Local stdio is self-hosted and instead uses only the upstream provider credentials you choose to configure.

Create an API key

1. Go to /dashboard/keys
2. Enter your email address
3. Open the sign-in link sent to your inbox
4. Store the key shown on the dashboard in your secret manager or environment

Interactive MCP OAuth

Most documented interactive clients connect directly to Hive's managed remote MCP endpoint with only its URL:

Many clients use a JSON shape like this:

{
  "mcpServers": {
    "hive": {
      "url": "https://mcp.hiveintelligence.xyz/mcp"
    }
  }
}

Client field names vary. VS Code uses a top-level servers object, Gemini CLI uses httpUrl, Windsurf uses serverUrl, and Claude Desktop uses the Custom Connectors UI. OpenAI Responses API is a headless exception that passes a key through tools[].authorization. Use Install Hive or Client Setup for the exact client-specific config.

After saving the config, restart the client or reload its MCP server list, then ask for a live price query and confirm the answer shows a Hive tool call.

Using your API key

REST API

Pass the key as a request header. Authorization: Bearer is the recommended form; x-api-key is accepted as a legacy alias.

Authorization: Bearer (recommended):

curl -X POST https://mcp.hiveintelligence.xyz/api/v1/execute \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_HIVE_API_KEY" \
  -d '{"tool": "get_price", "args": {"ids": "bitcoin", "vs_currencies": "usd"}}'

x-api-key (also supported):

curl -X POST https://mcp.hiveintelligence.xyz/api/v1/execute \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_HIVE_API_KEY" \
  -d '{"tool": "get_price", "args": {"ids": "bitcoin", "vs_currencies": "usd"}}'

Both authenticate identically. Prefer Bearer. It is the standard HTTP auth scheme and works with most clients, proxies, and SDKs.

Local stdio server

Use local stdio when your MCP client requires a subprocess or when you want to run Hive with your own upstream provider credentials. A hosted HIVE_API_KEY is not required for this mode:

{
  "mcpServers": {
    "hive-local": {
      "command": "npx",
      "args": ["-y", "-p", "hive-intelligence@latest", "hive"]
    }
  }
}

The local server calls providers directly. Keyless providers remain available; tools backed by a provider whose credential is absent remain discoverable and return a classified missing_key status. Add variables such as COINGECKO_DEMO_API_KEY, ALCHEMY_API_KEY, HELIUS_API_KEY, or MORALIS_API_KEY to the subprocess env only when you want those local provider integrations.

TypeScript MCP client adapter

If you install the hive-mcp-client adapter (npm install hive-mcp-client), pass the key at client initialization:

import { createHiveMcpClient } from 'hive-mcp-client';

const client = await createHiveMcpClient({
  apiKey: process.env.HIVE_API_KEY,
  clientName: 'my-app',
});

Store keys in environment variables. Never hardcode them in source files.

B2B subject signing

B2B partner backends keep one Hive API key server-side and add signed subject headers for each downstream customer request. Store the subject signing secret separately from the API key, for example as HIVE_SUBJECT_SIGNING_SECRET, and derive tenantId plus endUserId from trusted server auth state.

Do not accept tenant or end-user ids from a model prompt or browser body without validating them against your own session. The partner guide covers the full header contract and readiness check: B2B Partner Adapter.

Key management

From /dashboard/keys you can:

• Create multiple keys: one per project or environment (development, staging, production).
• Revoke a key: disables the key so new authenticated requests are rejected after auth-backend propagation.
• Track usage: see request counts and last-used timestamps per key.

Treat a revoked key as retired immediately in your own systems. New requests using a disabled key are rejected after the authentication backend observes the update; already in-flight requests may complete.

Rate limits

Each API key has its own rate limit quota based on your plan. See Rate Limits for plan quotas, retry headers, upstream provider-error behavior, and caching guidance.

Related

• Quick Start - make your first authenticated REST, MCP, or CLI call
• Install Hive - exact remote MCP config for supported AI clients
• Client Setup - tabbed setup guide for remote MCP, CLI, and REST
• API Integration - execute tools with the recommended Bearer header
• B2B Partner Adapter - isolate downstream customer state with signed subject headers
• MCP Security - keep API keys and subject secrets out of prompts and browser code