One Shared Key for Everyone
Use global auth when every caller should hit your API with the same credentials. You store one credential on the installation and the server uses it for every request—agents and users never see it.
How it works
You store one credential (OAuth, API key, or bearer token) on the installation. On every call, the server authenticates to your upstream API with that stored credential. The caller never provides an API key of their own; they only need to be allowed to connect (see Authentication).
Set it up
- In the Scalar Dashboard, open your MCP installation.
- Set authentication to Global.
- Store the credential the server should use—OAuth, an API key, or a bearer token.
Combine this with access control that fits your audience: keep it public for an open API, or attach an access group to limit who can connect.
Per-customer keys
Global auth stores one key per installation. If you need a different stored key per customer, create one installation per customer, each with its own stored credential and its own access group. See Private access for customers. If instead each customer should bring their own key, use passthrough auth.
Related
- Authentication — the two layers, and the other recipes
- Private access for customers — gate the server with access groups and OAuth
