> ## Documentation Index
> Fetch the complete documentation index at: https://docs.morphic.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys only — no usernames, passwords, or account IDs.

Morphic MCP uses a single credential type everywhere: **API keys**. There is no email, password, user ID, or account ID required.

## Getting an API key

1. Log in to [app.morphic.io](https://app.morphic.io)
2. Go to **`https://app.morphic.io/home/{workspace}/settings/developers`** — replace `{workspace}` with your workspace name
3. Click **Generate new key** and give it a label
4. Copy the key — it is shown **only once**

## Using your API key

Pass the key in either header on every request:

```bash theme={null}
# Option 1 — Authorization header (recommended)
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx

# Option 2 — X-API-Key header
X-API-Key: sk_live_xxxxxxxxxxxxxxxxxxxxxxxx
```

<Note>
  Account and workspace context are derived automatically from the key. You never need to supply an account ID or workspace ID separately.
</Note>

## How validation works

The MCP server validates every key by calling `GET /api/accounts/me` on the Morphic backend. Results are cached in memory for **2 minutes** per token to avoid a round-trip on every tool call.

## Claude.ai web connector (OAuth)

Claude.ai's web connector uses OAuth 2.0 + PKCE — it cannot store a static API key directly. The MCP server bridges this:

<Steps>
  <Step title="Connect in Claude.ai">
    Add `https://mcp.morphic.io/v1/mcp` as a connector. Claude.ai opens an OAuth flow.
  </Step>

  <Step title="Enter your API key">
    You'll be redirected to a Morphic page. Paste your `sk_live_...` key and click **Connect**.
  </Step>

  <Step title="Done">
    Claude.ai stores the key. All future tool calls use it as a bearer token — identical to every other client.
  </Step>
</Steps>

<Info>
  The MCP connector never asks for your email or password. If you see an email/password form, you are on the regular Morphic app login page, not the MCP connector.
</Info>

## Revoking a key

Revoke any key at `https://app.morphic.io/home/{workspace}/settings/developers`. The MCP server rejects it within 2 minutes (the cache TTL).

## Environment variables (self-hosted)

| Variable            | Description                            | Required                                  |
| ------------------- | -------------------------------------- | ----------------------------------------- |
| `MORPHIC_API_KEY`   | Default key for stdio / local dev mode | No                                        |
| `BACKEND_API_URL`   | Morphic backend URL                    | No (defaults to `https://api.morphic.io`) |
| `OAUTH_CODE_SECRET` | Secret for signing OAuth codes         | **Yes in production**                     |
| `PORT`              | HTTP port                              | No (default `3100`)                       |