Use apiKey() for internal or development gates only. It validates a header and does not set ctx.user. This is not MCP OAuth.

import { defineConfig } from "bitmcp";
import { apiKey } from "bitmcp/auth/api-key";

export default defineConfig({
  auth: apiKey({ env: "API_KEY" }),
});

Clients send the key in the x-api-key header by default.

Options

apiKey(options?: {
  env?: string;
  headerName?: string;
  validate?: (key: string) => boolean | Promise<boolean>;
})

Option	Default	Description
`env`	`"API_KEY"`	Environment variable name
`headerName`	`"x-api-key"`	Request header to read
`validate`	compares to env value	Custom validation function

For production user identity, use an OAuth provider from Supabase, Auth0, Better Auth, or Custom.

API key

Options