Access keys

Interactive clients sign in with OAuth. Anything that cannot open a browser authenticates with a key instead. Both reach the same endpoint and the same Proofable profile.

Sign in with	Use it for
OAuth	Chats, editors, and other clients a person signs into
Access key	Servers, CI, cron and scheduled jobs, containers, cloud agents, and gateways

Create a key

Create it

Open Access keys in your profile and create a key. Keys start with npk_.

Store it

Save it in your secret manager or CI secrets as PROOFABLE_ACCESS_KEY.

export PROOFABLE_ACCESS_KEY=npk_...

An access key acts as your whole profile. Keep it on servers. Never put it in browser code, chat, or a repository.

Use it

MCP
SDK
HTTP
Containers

{
  "mcpServers": {
    "proofable": {
      "type": "http",
      "url": "https://mcp.proofable.me/mcp",
      "headers": {
        "Authorization": "Bearer ${PROOFABLE_ACCESS_KEY}"
      }
    }
  }
}

Or let the CLI write it for your editors:

npx -y @proofable/sdk setup --access-key $PROOFABLE_ACCESS_KEY

import { ProofableClient } from '@proofable/sdk';

const client = new ProofableClient({ apiKey: process.env.PROOFABLE_ACCESS_KEY });

The SDK sends the key as Authorization: Bearer npk_....

Send the key on every request:

Authorization: Bearer npk_...

services:
  agent:
    image: your-agent-image:latest
    environment:
      - PROOFABLE_MCP_URL=https://mcp.proofable.me/mcp
      - PROOFABLE_ACCESS_KEY=${PROOFABLE_ACCESS_KEY}

Private cloud covers moving the same agent between environments.

Gateways that reserve the Authorization header for their own sign-in, such as Smithery, send the same key as x-proofable-access-key. MCP authentication

What a key can do

It works for MCP tools, the SDK, and the HTTP API.
It stays valid until you revoke it.
Proofs for your users still need their approval. Create those through server integrations.

Rotate or revoke

Create a new key, update the secret, then revoke the old key under Access keys. To revoke a key and remove it from local MCP config in one step:

npx -y @proofable/sdk disconnect --access-key $PROOFABLE_ACCESS_KEY

If a key is exposed, revoke it right away and issue a new one.

Private cloud

Run the same agent on your own infrastructure.

Add Proofable to any MCP client

Setup for every supported client.

Overview

Use cases

Compare

Reference

Legal

Guides

Create a key

Use it

What a key can do

Rotate or revoke

Next

Private cloud

Add Proofable to any MCP client

​Create a key

​Use it

​What a key can do

​Rotate or revoke

​Next

Private cloud

Add Proofable to any MCP client

Create a key

Use it

What a key can do

Rotate or revoke

Next