Free tools Windows power users keep installed
One-click scans. No signup required.
Yes, some remote MCP clients can send API keys, but support depends on how the server expects to receive the credential. Claude Code, VS Code, and Windsurf Cascade document custom headers; Claude Desktop has a vendor-specific URL-key example and may need a bridge for custom headers. ChatGPT Developer mode’s reviewed guide lists OAuth, no authentication, and mixed authentication—not a generic static API-key header. Cursor’s documented Atlassian setup does not establish arbitrary-header support for every server.
“Works” means the client supports both the server’s remote transport and its particular authentication method. The comparison below reflects official client and vendor documentation reviewed on October 2, 2026, not a common server tested across all six clients.
As an Amazon Associate I earn from qualifying purchases.
What to check before connecting
Remote transport and authentication are separate compatibility checks. A client may connect to remote MCP servers but still lack the credential mechanism a particular server requires. Check these details in the server’s documentation:
- Transport: Does it offer Streamable HTTP/HTTP Stream, SSE, or both?
- Credential mechanism: Does it expect a custom HTTP header, a URL query parameter, OAuth, or another method?
- Exact format: What is the required header name and value format—for example, whether the value needs a prefix such as
Bearer? - Client support: Does the client document that mechanism generically, or is the evidence limited to a particular vendor integration?
Which of the six clients support API-key access?
| Client | Documented remote-server credential options | Important qualification |
|---|---|---|
| Claude Code | Custom API-key or bearer headers; environment-variable expansion is available in JSON configuration. OAuth is also supported for servers that implement it. | Use the header name and token format the server requires. Claude Code documentation |
| VS Code | Remote HTTP configuration can include headers or OAuth. Input variables can prompt for sensitive values and securely store them for later use. | VS Code tries HTTP Stream first and falls back to SSE when HTTP is unsupported. That transport behavior does not establish whether the server accepts a particular key. VS Code MCP configuration reference |
| Windsurf Cascade | Remote HTTP configuration supports a headers object, with values interpolated from environment variables or files. | The documented example uses a custom API_KEY header; confirm the exact header name and value format with your server. Windsurf MCP documentation |
| Claude Desktop | A reviewed ABsmartly guide puts an API key in the remote endpoint URL. It says to use mcp-remote to pass a key as a header. |
This is a service-specific setup, not evidence that every Claude Desktop connector supports URL keys. The guide says Claude Desktop does not natively support custom headers for remote servers. ABsmartly’s Claude Desktop guide |
| ChatGPT Developer mode | The reviewed guide documents OAuth, no authentication, and mixed authentication for remote MCP. | It covers SSE and streaming HTTP, but does not document a generic static API-key header mode. Direct connection to a raw API-key-only server is therefore not established by that guide. OpenAI Developer mode guide |
| Cursor | Atlassian documents a Cursor integration and says its MCP server can optionally use API-token authentication. | An Atlassian-specific integration does not establish generic arbitrary-header configuration for other servers. Verify the exact integration and credential method. Atlassian remote MCP server documentation |
How to configure a key in clients with documented header support
Claude Code
Claude Code’s documented command pattern for a remote HTTP server is:
#1 Best Overall
claude mcp add --transport http <name> <url> --header "Authorization: Bearer $TOKEN"Replace the URL, header name, and value format with those required by the server. The command illustrates the header mechanism; do not put a real secret in a published example or shared shell history. Claude Code’s JSON configuration also accepts headers and environment-variable expansion. See the official configuration guide for the current syntax.
VS Code
Put workspace MCP settings in .vscode/mcp.json under the top-level servers object. A remote entry can specify its URL and optional headers or OAuth settings. Use VS Code’s sensitive input-variable prompt for a secret rather than committing a literal key to the workspace configuration. The VS Code reference documents secure storage after the first entry and automatic handling of the OAuth flow when OAuth is configured.
Rank #2
Windsurf Cascade
Remote configuration accepts serverUrl or url along with a headers object. The documented interpolation forms include ${env:VAR_NAME} for an environment variable and ${file:/path} for a file value. The exact header and token format still come from the server’s own requirements; see Windsurf’s MCP configuration documentation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Claude Desktop: URL key or bridge?
Claude Desktop’s options depend on the server integration. ABsmartly documents a service-specific setup in which the key is placed in the remote endpoint URL. For a server that requires a custom header, the same guide recommends mcp-remote as a bridge because, according to that guide, Claude Desktop does not natively support custom headers for remote servers. This should not be generalized into a universal URL-key path: follow the instructions for the particular server you are connecting to.
Rank #3
ChatGPT Developer mode and API-key-only servers
The reviewed OpenAI guide describes remote MCP over SSE and streaming HTTP and names OAuth, no authentication, and mixed authentication. It does not list a general-purpose static API-key header option. If a server accepts only a static key in a custom header, the guide does not establish that it can connect directly; do not assume that selecting remote MCP or an authentication mode will supply the required header.
What Cursor’s Atlassian example does—and does not—show
Atlassian recommends https://mcp.atlassian.com/v2/mcp and lists setup options for Cursor as well as Claude Code, Claude Desktop, VS Code/GitHub Copilot, and Windsurf. For Atlassian’s server specifically, API-token authentication may be disabled by an organization administrator, and scoped credentials are required. Atlassian also describes API-token authentication for headless, service-style, or non-interactive client setups.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
These details establish an Atlassian-specific integration, not that Cursor can attach arbitrary headers to any remote MCP server. Check the relevant server’s Cursor instructions and your organization’s authentication policy before relying on a key-based connection.
Keep API keys out of shared configuration
Prefer a client’s documented secret prompt, environment-variable support, or file interpolation over a literal key in a configuration file. A URL-key setup can also expose a credential wherever that URL is copied or logged, so use it only when the service documents that method and handle the endpoint as sensitive. Follow your organization’s credential-storage rules, and never include a real secret in an example or checked-in configuration.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
