Copy page

Authentication

Account API Keys

An Account API Key authenticates programmatic calls to MewCP's management APIs. Your backend uses this key to start OAuth flows for audience, get hosted credential form URLs, and manage audience member credential state via the MewCP Auth API.

---

Format

Code
mewcp_acct_<hex_token>

Example: mewcp_acct_7df44e73e8cd42bbf4860ffc66520efb62d973615dc2c0f7fb5607fb82d75b53

---

How to get one

---

How to use it

Pass it as a Bearer token in the Authorization header. Every MewCP Auth API endpoint also requires an x-mewcp-key header: the API Key of the specific business-mode server you're acting on (see API Key). The two are not interchangeable and both are required:

Code
curl https://gateway.mewcp.com/end-users \
  -H "Authorization: Bearer mewcp_acct_YOUR_KEY" \
  -H "x-mewcp-key: mcp_live_YOUR_SERVER_KEY"

TypeScript:

Code
const res = await fetch("https://gateway.mewcp.com/end-users", {
  headers: {
    Authorization: `Bearer ${process.env.MEWCP_ACCOUNT_KEY}`,
    "x-mewcp-key": process.env.MEWCP_SERVER_KEY,
  },
});

Python:

Code
import httpx
resp = httpx.get(
    "https://gateway.mewcp.com/end-users",
    headers={
        "Authorization": f"Bearer {MEWCP_ACCOUNT_KEY}",
        "x-mewcp-key": MEWCP_SERVER_KEY,
    },
)

---

What you can do with it

Action	Endpoint
Start OAuth flow for a user	POST /oauth/{provider}/start
Get hosted static credential form	POST /credentials/static/{providerSlug}/connect
List audience for a server	GET /end-users
Get an audience member's credentials	GET /end-users/{externalUserId}
Revoke a user's credential	DELETE /end-users/{externalUserId}

Every action above is scoped to the single server identified by x-mewcp-key. There's no call that lists or manages audience across every server at once.

Full reference in the MewCP Auth API docs.

---

Best practices

• Keep it server-side only. Never expose Account API Keys in frontend code or mobile apps.
• One key per environment. Use separate keys for production, staging, and local development.
• Revoke if compromised. Go to Developer -> Account API Keys and click Revoke.