API Keys

AllMCP uses API keys to authenticate requests and identify the client making the call.

Getting a key

Sign up and open the dashboard

Sign up or log in at allmcp.co/login, then go to Dashboard → API Keys → Create key.
Copy your key

Keys look like:
```
allmcp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

How to pass the key

Both methods work identically. X-API-Key is preferred because it’s more explicit and avoids confusion with other Bearer token schemes.

X-API-Key header (preferred)
Authorization Bearer

X-API-Key: allmcp_xxxxx

Authorization: Bearer allmcp_xxxxx

Key types

All key types look the same (allmcp_...). The difference is in what tenants are scoped to the key — configured in the AllMCP dashboard.

Type	Usage
Solo key	One developer, one user. Used in Claude Desktop, Cursor, personal agents.
Client key	One company, multiple users. Your team connects with `?user_id=`.
Platform key	One platform, multiple orgs + users. Multi-tenant SaaS. Use `?org_id=` + `?user_id=`.

Key security

In code, load keys from environment variables, not hardcoded strings:

import os
api_key = os.environ["ALLMCP_API_KEY"]

In .env:

ALLMCP_API_KEY=allmcp_xxxxx

Key scoping in config files

# .gitignore
.cursor/mcp.json
.vscode/mcp.json

Rate limits and quotas

Rate limits are per API key and per provider. Provider-level limits (e.g., Bitrix24’s ~2 req/sec per webhook) are enforced by the provider, not AllMCP. AllMCP itself does not impose additional rate limits at this time.