MewCP Auth API

B2B API for connecting your audience to MCP-powered tools via OAuth or static credentials.

MCP servers require two things to work for your users: hosting and credential management. MewCP provides both. You call this API from your backend, MewCP handles everything else - OAuth handshakes, token storage, automatic refresh, and encrypted credential vaults. Your users connect their accounts; your backend only ever holds an opaque externalUserId.

Authentication

Every endpoint requires an Account API Key passed as a Bearer token:

Code
Authorization: Bearer mewcp_acct_YOUR_KEY

Generate an Account API Key from your MewCP dashboard under Developer -> Account API Keys.

Every endpoint also requires an x-mewcp-key header carrying the API Key of the server you're acting on:

Code
Authorization: Bearer mewcp_acct_YOUR_KEY
x-mewcp-key: mcp_live_YOUR_SERVER_KEY

This is the same API Key used to authenticate MCP client connections (see API Key), and it must be a business-mode server key. For /oauth/{provider}/start and /credentials/static/{providerSlug}/connect it must also match the provider/providerSlug in the path. Without it, these endpoints return 401/400.

OAuth vs Static Credentials

	OAuth	Static Credentials
Use when	Provider supports OAuth (Google, Slack, GitHub, Notion…)	Provider uses API keys or secrets (Gemini, Razorpay, Firecrawl…)
User experience	Standard OAuth popup/redirect login	Hosted form where user pastes their key
Token refresh	Automatic - MewCP refreshes before expiry	Not applicable
Your backend stores	Nothing - only `externalUserId`	Nothing - only `externalUserId`

Integration guides

For step-by-step integration instructions, including frontend popup setup, local testing flows, and how to handle success/error callbacks, see the dedicated guides:

Quick reference

OAuth flow:

Register your OAuth app in the MewCP dashboard under Credentials → OAuth Apps
Call POST /oauth/{provider}/start with externalUserId (+ optional frontendCallbackUrl), sending both your Account API Key (Authorization) and the server's API Key (x-mewcp-key)
Open the returned authUrl for your user - as a popup or direct browser open
MewCP completes the handshake, encrypts and stores the tokens

Static credentials flow:

Call POST /credentials/static/{providerSlug}/connect with externalUserId (+ optional frontendCallbackUrl), sending both your Account API Key (Authorization) and the server's API Key (x-mewcp-key)
Send the returned hostedFormUrl to your user - it expires in 5 minutes
User fills in their API key on MewCP's hosted page
MewCP encrypts and stores the credentials in vault