The agent should never see the API key. Let the MCP server obtain and hold the upstream credential, keep it out of prompts, chat and tool arguments, store it in a secrets store, and give the MCP client a separate, narrowly scoped authorization for the server itself. Never forward the token the client presents to your server on to an upstream API.
This article lays out that pattern as five rules, explains the two trust relationships behind it, and notes which protocol details depend on the specification and SDK version you use. It is based on official MCP and OWASP documentation, not on hands-on testing of any particular server or vault.
As an Amazon Associate I earn from qualifying purchases.
The pattern in five rules
1. Keep the upstream secret away from the agent and client
Do not ask users to paste provider API keys into chat, agent instructions or tool arguments. Anything placed there can end up in model context, transcripts and logs. The MCP project describes URL-mode elicitation as a way for a server to send the user to an out-of-band browser flow. Its November 2025 specification release post states: “API keys and passwords never transit through the MCP client.” That is a statement from the MCP project, not from an individual.
2. Let the server obtain and manage upstream credentials
In that flow the user finishes authentication in a browser and the server obtains the tokens it needs directly. The client only needs its own authorization flow to the MCP server. Not every client or server implements URL-mode elicitation, so check support in your client, server and specification version before writing setup instructions for users.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Treat the two trust relationships separately
Two different credentials are in play:
| Credential | Who presents it | Who validates it | Rule |
|---|---|---|---|
| MCP access token | Client | Your MCP server, as the protected resource | Accept only tokens issued for your server (audience check). Never pass it to an upstream API. |
| Upstream API key or token | Your MCP server | The upstream provider | Held server-side only, never returned to the client or model. |
The MCP Apps authorization guide and the OWASP MCP Security Cheat Sheet both support this separation. Forwarding the MCP token upstream (token passthrough) blurs the boundary: the upstream service would be trusting a token not minted for it.
4. Use least privilege and proper storage
OWASP’s cheat sheet puts it directly: “Use scoped, per-server credentials — never share tokens across servers.” In practice:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Issue one credential per server, with only the API permissions that server needs.
- Prefer short-lived tokens where the provider and your workflow allow it.
- Keep API keys and client credentials in a secrets store or vault, not in plaintext config files, repositories or environment dumps. OWASP also recommends OS-native secure storage for OAuth tokens and warns against plaintext token configuration (see the cheat sheet and its Practical Guide for Secure MCP Server Development, published 2026-02-16).
- Plan rotation, revocation and audit logging up front; a secret you cannot rotate quickly is a liability.
5. Enforce authentication at the boundary
Do not rely on a system prompt or tool description to protect an operation. Verify bearer tokens in server code before a tool runs. The MCP Go SDK documentation describes middleware that verifies bearer tokens and can check expiration and scopes; other SDKs offer their own mechanisms.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA secrets manager does not replace this. Storage protects the secret at rest; resource authorization, upstream credential management and tool permissions are three distinct controls, and you need all of them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Evaluating a credential approach
When comparing designs, ask these questions, which follow the MCP and OWASP guidance:
- Who enters the secret, and does it ever reach the model or client?
- Where does the server store it?
- Is each credential scoped per server and per operation?
- Are tokens short-lived, and validated for the correct audience and issuer?
- How are revocation, rotation and audit handled?
A design that has users paste keys into chat fails the first question immediately. A shared long-lived key in a config file fails the second through fourth.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Version-specific protocol notes
The MCP project’s 2026-07-28 specification release summary says that clients must validate the iss parameter in the authorization response, that credentials are bound to the issuer that minted them, and that Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents (CIMD), with DCR retained for backward compatibility. These are facts about that release; older implementations may behave differently.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The TypeScript SDK documentation identifies v2 as the stable line implementing the 2026-07-28 specification. If you write code, pin an SDK version, check that version’s docs, and do not mix v1 and v2 snippets. Identify your transport and specification version before copying any example.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Practical rules for code and operations
- Never put real keys in code samples, screenshots, prompts, logs or tool inputs; redact them in error messages returned to the model.
- Tool results should return data, not credentials or authenticated URLs containing secrets.
- Read upstream secrets from the secrets store at runtime, inside the server process, rather than accepting them as tool parameters.
- Where URL-mode elicitation is unavailable, fall back to server-side configuration by an administrator rather than asking users to type keys into the conversation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
