Authentication guide
OpenAPI to MCP Authentication: Bearer Tokens and API Keys
The credential used by an MCP server to call an upstream REST API should never be embedded in the generated source or pasted into a browser generator. It belongs in the runtime environment of the downloaded server.
Generate your MCP serverBearer token mapping
For an OpenAPI HTTP bearer scheme, the generated client reads UPSTREAM_BEARER_TOKEN and sends it as the Authorization header. The downloaded .env.example contains a placeholder, not a secret.
Authorization: Bearer $UPSTREAM_BEARER_TOKEN
API key mapping
OpenAPI apiKey schemes define both the parameter name and its location. The generator can place UPSTREAM_API_KEY in a header such as X-API-Key or in the query string when the contract explicitly requires it.
Upstream auth is not MCP client auth
A server can hold a valid upstream credential and still be unsafe to expose. Remote MCP deployments need a separate way to authenticate the connecting user, authorize individual tools, and prevent one user from inheriting another user’s access.
Frequently asked questions
Can I paste a real API key into SpecToMCP?
Do not paste credentials. The tool only needs the security scheme from your OpenAPI document and generates environment-variable placeholders.
Does the MVP generate OAuth?
No. OAuth requires provider-specific authorization, callback, token refresh, storage, and user-scoping decisions that cannot be safely inferred from a schema alone.