MewCPMewCP
  • AstheTech
  • Contact Us
  • Documentation
  • MewCP Auth API
Have a question?
  • ✉ Contact us - our dev team will reach out as soon as possible

© 2026 MewCP. All rights reserved.

githubx
Getting Started
Connect AI Apps
Frameworks & SDKs
Authentication
Auth API Guides
    OAuth Integration GuideStatic Credentials Integration Guide
powered by Zudoku
Auth API Guides

Static Credentials Integration Guide

Some MCP server providers - like Gemini, Razorpay, Firecrawl, OpenAI, and others - don't use OAuth. They issue API keys or secrets that users paste in manually. MewCP handles this with a hosted form: you generate a secure link, your user opens it, fills in their credentials, and MewCP encrypts and stores them. You never see or handle the raw keys.


What MewCP does for you

  • Generates a short-lived, signed form URL for each user
  • Hosts the credential input form - no frontend work required from you
  • Encrypts all sensitive fields (API keys, secrets) before storage in MewCP's vault
  • Ties every credential to an externalUserId you supply
  • Handles success and failure feedback - either redirecting to your app or showing a confirmation page

Before you start

  1. Add the MCP server to your subscription: the provider (e.g. gemini, razorpay) must be an active server in your MewCP subscription. If it isn't, the API returns 403. Add it from Dashboard → Servers → Add Server.

  2. Get the server's API Key: go to Dashboard (mode=business) → Servers → select server → select key → Copy Key. You'll send this on every POST /credentials/static/{providerSlug}/connect call, alongside your Account API Key, see below.


Integration flow

  1. Generate a hosted form URL

    Call POST /credentials/static/{providerSlug}/connect from your backend. Two headers are required: your Account API Key (Authorization) and the API Key of the specific server you're connecting this user to (x-mewcp-key). Pass the user's ID and, if you have a frontend, a callback URL. You can also pass optional user metadata, which MewCP stores alongside the credential for display in your dashboard:

    Code
    POST /credentials/static/gemini/connect Authorization: Bearer MEWCP_ACCT_API_KEY x-mewcp-key: MEWCP_API_KEY { "externalUserId": "user_123", "frontendCallbackUrl": "https://yourapp.com/credentials/callback", "externalUserMeta": { "name": "Jane Smith", "email": "jane@example.com", "username": "janesmith" } }
    FieldRequiredDescription
    externalUserIdYesYour internal user identifier
    frontendCallbackUrlNoWhere MewCP redirects the user after form submission
    externalUserMeta.nameNoUser's display name, stored for your reference
    externalUserMeta.emailNoUser's email, stored for your reference
    externalUserMeta.usernameNoUser's username, stored for your reference

    If x-mewcp-key is missing, invalid, not a business-mode server key, or belongs to a different provider than {providerSlug} in the path, the call fails with 401/400 before any form URL is generated.

    You get back:

    Code
    { "hostedFormUrl": "https://gateway.mewcp.com/connect/static?token=...", "expiresInMinutes": 5 }

    The URL is valid for 5 minutes. Generate it close to when the user will open it.

  2. Send the URL to your user

    If you have a frontend (web app):

    Redirect the user to the hostedFormUrl, or open it as a new tab:

    Code
    // Redirect the current page window.location.href = hostedFormUrl; // Or open as a new tab window.open(hostedFormUrl, "_blank");

    After the user submits their credentials, MewCP redirects to your frontendCallbackUrl:

    ResultQuery params on your callback URL
    Success?provider=gemini&success=true
    ErrorMewCP shows an error page with details

    Handle the result on your callback page:

    Code
    // On your frontendCallbackUrl page const params = new URLSearchParams(window.location.search); if (params.get("success") === "true") { // show success, redirect to dashboard, etc. }

    If you have no frontend (local tools / server-only setups):

    Open the hostedFormUrl in a browser, fill in the API key, and submit. MewCP will show a "Connected" confirmation page. The credential is saved, no further action needed.

    Other delivery methods:

    • Email the link to the user
    • Show it as a button in your app's settings page
    • Send it via an in-app notification

    Just ensure the user opens it within 5 minutes of generation.

  3. Use the connection 🚀

    Once connected, route your user's MCP requests through the gateway with their externalUserId in the header:

    Code
    x-external-user-id: user_123

    MewCP resolves the stored credential and injects it into the provider call.


Security

  • All sensitive fields (API keys, secrets) are encrypted at rest in MewCP's vault
  • The form URL contains a short-lived signed token - it cannot be reused or tampered with
  • Your backend never handles raw credentials - only the externalUserId reference
  • You can revoke a user's credential at any time via the Audience API
Last modified on October 15, 2026
OAuth Integration Guide
On this page
  • What MewCP does for you
  • Before you start
  • Integration flow
  • Security
JSON
Javascript
Javascript