Access keys

Interactive clients sign in with OAuth. Anything that cannot open a browser uses a profile access key instead. Both reach the same endpoint and the same Proofable profile.

Sign in with	Use it for
OAuth	Chats, editors, and other clients a person signs into
Access key	Servers, CI, cron and scheduled jobs, containers, cloud agents, and gateways

Create a key

Create it

Open Access keys in your profile and create a key. Keys start with npk_.

Store it

Save it in your secret manager or CI secrets as PROOFABLE_ACCESS_KEY.

export PROOFABLE_ACCESS_KEY=npk_...

An access key acts as your whole profile. Keep it on servers. Never put it in browser code, chat, or a repository.

Use it

MCP
SDK
HTTP
Containers

{
  "mcpServers": {
    "proofable": {
      "type": "http",
      "url": "https://mcp.proofable.me/mcp",
      "headers": {
        "Authorization": "Bearer ${PROOFABLE_ACCESS_KEY}"
      }
    }
  }
}

Or let the CLI write it for your editors:

npx -y @proofable/sdk setup --access-key $PROOFABLE_ACCESS_KEY

import { ProofableClient } from '@proofable/sdk';

const client = new ProofableClient({ apiKey: process.env.PROOFABLE_ACCESS_KEY });

The SDK sends the key as Authorization: Bearer npk_....

Send the key on every request:

Authorization: Bearer npk_...

services:
  agent:
    image: your-agent-image:latest
    environment:
      - PROOFABLE_MCP_URL=https://mcp.proofable.me/mcp
      - PROOFABLE_ACCESS_KEY=${PROOFABLE_ACCESS_KEY}

Private cloud covers moving the same agent between environments.

Gateways that reserve the Authorization header for their own sign-in, such as Smithery, send the same key as x-proofable-access-key. MCP authentication

What a key can do

It acts as your full profile for MCP tools, the SDK, and the HTTP API.
It does not expire. Revoke it when you no longer need it.
It does not replace a user’s approval. To create proofs for your users, use server integrations.

Rotate or revoke

Create a new key, update the secret, then revoke the old key under Access keys. To revoke a key and remove it from local MCP config in one step:

npx -y @proofable/sdk disconnect --access-key $PROOFABLE_ACCESS_KEY

If a key is exposed, revoke it right away and issue a new one.

Private cloud

Run the same agent on your own infrastructure.

Server integrations

Create proofs for your users from your backend.

MCP authentication

OAuth, access keys, and token security.

Connect an AI client

Setup for every supported client.

Overview

Common use cases

Products

Guides

Create a key

Use it

What a key can do

Rotate or revoke

Next

Private cloud

Server integrations

MCP authentication

Connect an AI client

​Create a key

​Use it

​What a key can do

​Rotate or revoke

​Next

Private cloud

Server integrations

MCP authentication

Connect an AI client

Create a key

Use it

What a key can do

Rotate or revoke

Next