Use the API-key MCP fallback safely

Use an API key only when the OAuth path is unavailable

Start with OfflineCreator's remote OAuth endpoint when the client supports browser authorization. The API-key fallback exists for a local stdio process or a legacy remote client that can attach a fixed HTTP header. It is not a shortcut for putting a credential into the server URL.

For either fallback, create a dedicated personal key in Studio Settings and place it in the client's secret or environment configuration. Do not paste the key into chat, commit it to a repository, or share a project configuration that contains the literal value. If the client cannot keep a secret out of the URL and source-controlled files, do not use that client for the key-based path.

Preferred

Remote OAuthUse https://mcp.offlinecreatorstudio.com/mcp and complete browser consent.

Fallback A

Local stdioRun @offlinecreator/mcp locally and inject OFFLINECREATOR_API_KEY through secret configuration.

Fallback B

Legacy remote headerUse https://offlinecreatorstudio.com/mcp only when the client supports a fixed Authorization header.

Send a legacy remote key in the Authorization header

A remote fallback needs a client that can attach `Authorization: Bearer <API key>` to requests for `https://offlinecreatorstudio.com/mcp`, with the key resolved from protected configuration. OfflineCreator's live protected-resource metadata identifies that resource and advertises the header bearer method. Use the exact header-field mechanism documented by the client; configuration keys differ, so a snippet from one client is not proof that another accepts the same schema.

The current MCP authorization specification requires OAuth bearer access tokens in the Authorization header on every HTTP request and forbids those access tokens in the URI query string. A personal API key is not an OAuth access token, so that protocol rule does not by itself prove how OfflineCreator's backend validates personal keys. This page therefore documents only the first-party endpoint and header method, not an observed acceptance or rejection response.

Endpoint

https://offlinecreatorstudio.com/mcpThis is the documented legacy API-key endpoint, not the recommended OAuth hostname.

Header

Authorization: Bearer <API key>Resolve the key through the client's supported protected-secret syntax.

Configure the local stdio fallback without widening trust

A stdio client launches `npx -y @offlinecreator/mcp` and supplies `OFFLINECREATOR_API_KEY` in the server environment. The current published package, version 0.1.2, defaults its API origin to `https://offlinecreatorstudio.com`. Its configuration accepts that production host or a loopback host, requires HTTPS away from loopback, and rejects credentials embedded in an API-base URL.

Leave `OFFLINECREATOR_API_BASE` unset for normal production use. Changing the destination changes where the bearer credential is sent, and the current package does not document an override for an arbitrary remote host. For local image input, set `OFFLINECREATOR_UPLOAD_ROOT` to the narrow directory the process should read; the package defaults that root to the process working directory.

Command

npx -y @offlinecreator/mcpRun as a local MCP process under the client.

Required secret

OFFLINECREATOR_API_KEYStore the value in the client's secret or environment facility.

Production API origin

https://offlinecreatorstudio.comUse the package default instead of overriding the destination.

Match the secret channel to the client

Before enabling a fallback, verify both the endpoint hostname and the client feature that resolves the secret. Local stdio needs process-environment injection; the legacy remote path needs a fixed Authorization header whose value can come from protected environment configuration. A client that supports remote URLs but offers neither mechanism is not suitable for the API-key fallback.

Do not publish one interpolation token as universal syntax. Confirm the current client-owned field names, whether environment expansion is supported, and whether a project file is shared or source controlled. Keep the package on its production default origin, and treat any destination override as a separate staging decision with its own trust review.

Verify the selected fallback in layers

Test one fallback path at a time. First confirm that the client started the stdio process or connected to the exact legacy remote endpoint. Next confirm that the credential was resolved through the intended environment or header facility without printing it. Finally inspect the visible tools with the client's own status interface before invoking any generation.

Record the client version, configuration location, transport, secret channel, and actual tool names. If tools are missing, treat the cause as unverified until current client and product diagnostics identify it. The record establishes the tested configuration only and does not prove that another client accepts the same schema.

Credential channel

Process environment or fixed Authorization headerUse the mechanism supported by the selected stdio or legacy remote path.

Connected but tools are limited

Do not infer the causeUse current client and product diagnostics before attributing a limited tool list.

Continue with the path you selected

Use the stdio guide for local process and upload-root details, return to the client directory when you need a client-specific configuration schema, or use the connection checklist after the credential is in the correct channel.

Research boundary and current evidence gaps

This page owns the safe choice between OfflineCreator's stdio and legacy remote API-key fallbacks. It does not claim that every MCP client supports fixed headers or the same environment-variable interpolation syntax. Match the client to its current first-party schema before copying a configuration.