MCP clients that support a manually configured bearer token can authenticate with a normal Upscrape API key.

## Configuration

Use the MCP URL:

```text
https://data.upscrape.com/mcp
```

Send the API key as:

```http
Authorization: Bearer UPSCRAPE_API_KEY
```

The endpoint uses Streamable HTTP and expects JSON-RPC requests over HTTP `POST`.

## When to use this path

API-key authentication is appropriate for a trusted development tool, internal service, or client that cannot complete OAuth discovery and authorization.

Prefer OAuth for third-party consumer connectors. Copying a long-lived API key gives the client direct account access and makes independent revocation and consent harder to reason about.

## Key handling

- Put the key in the client's protected secret field, not in the server URL.
- Do not include it in query parameters.
- Use a dedicated key when possible so it can be revoked independently.
- Never paste a real key into a support request or an agent conversation.