Skip to main content

Authentication & access

Every request to EDITED MCP carries an API key in the x-api-key header. There's no OAuth flow, token refresh, or session to manage — one header, sent on every call.

Get an API key​

API keys are issued by EDITED. To request one — or to check whether your existing EDITED account already includes MCP access — contact your EDITED account manager or customer success representative, or email support@edited.com.

Your key works against the production endpoint:

https://mcp.edited.com/mcp

Send the key​

Add the header to every request. With curl:

curl -s https://mcp.edited.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }'

With the official SDKs, set the header once on the transport and every call inherits it — see Connect a custom client for TypeScript and Python examples, or the Claude Desktop and Claude Code recipes for client-app setup.

When authentication fails​

A missing key — or one that isn't enabled for MCP — gets 401 Unauthorized. A 401 is always about the key, never about your request body, so it's also the quickest way to verify a new key: send any request and check the status. See Errors for the full error model.

Keep your key safe​

Treat the key like a password:

  • Use environment variables, not source code or committed config. The Claude Code recipe shows the ${EDITED_MCP_API_KEY} pattern that keeps a shared .mcp.json free of secrets.
  • The "Try it" widget stores your key in your browser only (localStorage) — it is never sent anywhere except the MCP endpoint.
  • Rotate a leaked key immediately by contacting your EDITED account manager or support@edited.com.