Authentication
Every request uses a Bearer token. API keys are accepted only in the Authorization header.
Authentication#
Send Authorization: Bearer sm_live_.... Never place the full key in URLs, cookies, bodies, logs, or analytics.
Key format#
Keys use sm_live_ plus a 43-character base64url secret. Old smcp_live_ tokens are rejected.
Scopes#
api:read allows REST reads. mcp:read allows MCP tools. New keys default to both.
Rotation#
A new key works immediately. The previous key remains in rotating state for 24 hours and can be revoked early.