Static Credentials Integration Guide
Some MCP server providers - like Gemini, Razorpay, Firecrawl, OpenAI, and others - don't use OAuth. They issue API keys or secrets that users paste in manually. MewCP handles this with a hosted form: you generate a secure link, your user opens it, fills in their credentials, and MewCP encrypts and stores them. You never see or handle the raw keys.
What MewCP does for you
- Generates a short-lived, signed form URL for each user
- Hosts the credential input form - no frontend work required from you
- Encrypts all sensitive fields (API keys, secrets) before storage in MewCP's vault
- Ties every credential to an
externalUserIdyou supply - Handles success and failure feedback - either redirecting to your app or showing a confirmation page
Before you start
-
Add the MCP server to your subscription: the provider (e.g.
gemini,razorpay) must be an active server in your MewCP subscription. If it isn't, the API returns403. Add it from Dashboard → Servers → Add Server. -
Get the server's API Key: go to Dashboard (mode=business) → Servers → select server → select key → Copy Key. You'll send this on every
POST /credentials/static/{providerSlug}/connectcall, alongside your Account API Key, see below.
Integration flow
-
Generate a hosted form URL
Call
POST /credentials/static/{providerSlug}/connectfrom your backend. Two headers are required: your Account API Key (Authorization) and the API Key of the specific server you're connecting this user to (x-mewcp-key). Pass the user's ID and, if you have a frontend, a callback URL. You can also pass optional user metadata, which MewCP stores alongside the credential for display in your dashboard:CodeField Required Description externalUserIdYes Your internal user identifier frontendCallbackUrlNo Where MewCP redirects the user after form submission externalUserMeta.nameNo User's display name, stored for your reference externalUserMeta.emailNo User's email, stored for your reference externalUserMeta.usernameNo User's username, stored for your reference If
x-mewcp-keyis missing, invalid, not a business-mode server key, or belongs to a different provider than{providerSlug}in the path, the call fails with401/400before any form URL is generated.You get back:
CodeThe URL is valid for 5 minutes. Generate it close to when the user will open it.
-
Send the URL to your user
If you have a frontend (web app):
Redirect the user to the
hostedFormUrl, or open it as a new tab:CodeAfter the user submits their credentials, MewCP redirects to your
frontendCallbackUrl:Result Query params on your callback URL Success ?provider=gemini&success=trueError MewCP shows an error page with details Handle the result on your callback page:
CodeIf you have no frontend (local tools / server-only setups):
Open the
hostedFormUrlin a browser, fill in the API key, and submit. MewCP will show a "Connected" confirmation page. The credential is saved, no further action needed.Other delivery methods:
- Email the link to the user
- Show it as a button in your app's settings page
- Send it via an in-app notification
Just ensure the user opens it within 5 minutes of generation.
-
Use the connection 🚀
Once connected, route your user's MCP requests through the gateway with their
externalUserIdin the header:CodeMewCP resolves the stored credential and injects it into the provider call.
Security
- All sensitive fields (API keys, secrets) are encrypted at rest in MewCP's vault
- The form URL contains a short-lived signed token - it cannot be reused or tampered with
- Your backend never handles raw credentials - only the
externalUserIdreference - You can revoke a user's credential at any time via the Audience API