Authentication
API keys, OAuth, and access control for RouterMCP.
Authentication
RouterMCP supports project access controls for clients and separate authentication for remote MCP servers that RouterMCP connects to. For the complete CIMD, DCR, and OAuth setup and verification steps, see OAuth with RouterMCP.
Project Authentication
Each project can be configured with an authentication mode:
| Mode | Description | Use Case |
|---|---|---|
none | No client authentication required | Development, internal tools |
api_key | Requires an Authorization: Bearer project API key | Clients that use a project API key |
oauth | OAuth 2.1 sign-in with Authorization Code and PKCE | OAuth-capable MCP clients |
Project access mode is configured on the project’s Access page. The Connect page shows the endpoint clients should use; when OAuth is selected, copy that endpoint as displayed.
API Key Authentication
When authMode is set to api_key:
POST /v1/mcp/my-project/request
Authorization: Bearer rmcp_<your-project-key>
Content-Type: application/jsonAPI keys are shown only once when created. Store them securely.
Authentication for Upstream Servers
Project access authentication is separate from credentials RouterMCP uses to connect to remote MCP servers. Configure those credentials for each server:
| Type | Description |
|---|---|
none | No authentication |
bearer | Bearer token in Authorization header |
oauth | OAuth authorization with the remote server; RouterMCP stores the resulting connection tokens |
Bearer Token
{
"mcpServers": {
"github": {
"url": "https://mcp.github.com",
"authType": "bearer",
"authBearer": "${GITHUB_TOKEN}"
}
}
}OAuth
On the project’s Servers page, choose Add Server, enter the remote MCP endpoint, and select OAuth. Connect the account that should own the upstream credentials. RouterMCP can reuse a registration for the same issuer, use CIMD when its stable public HTTPS metadata document is eligible, or try DCR when automatic CIMD selection is unavailable and the upstream provides a registration endpoint. A provider-issued static client ID and optional secret can be entered in OAuth Client Advanced Settings when automatic registration is unavailable. See OAuth with RouterMCP for the selection order and verification steps.
Best Practices
- Require authentication for protected projects - Use project API keys or OAuth as appropriate; intentionally public projects may use no client authentication
- Rotate keys periodically - Create new keys and revoke old ones
- Use environment variables - Never hardcode credentials
- Per-server credentials - Don't share tokens across servers
- Monitor audit logs - Watch for unauthorized access attempts