netlify-mcp-servers-authentication

MCP Server Authentication

Two models. Pick based on who calls the server. Both put Authorization: Bearer <token> on every request and 401 anything that fails.

Model 1 — single shared secret (personal / single-user)

One token in an env var, compared in constant time. This is the whole thing — see checkBearer in the main SKILL. Generate with openssl rand -hex 32, store as a secret env var, hand the same token to your one client. To rotate or revoke: set a new value and update the client.

Use this when the server is just for you (or one trusted script). Don't reach for anything heavier than this until you actually have multiple users.

Model 2 — per-user API keys (multi-user)

Each person authenticates as themselves with their own revocable key. Netlify Identity protects a web UI where users mint keys; the MCP endpoint itself is authenticated by the key, not by an Identity session (agents have no browser cookie). The two systems are separate on purpose.

Store keys in Netlify Database. The essential rules:

• Never store the plaintext key. Store a SHA-256 hash plus a short non-secret prefix for display.
• Show the plaintext exactly once, at creation. If the user loses it, they mint a new one.
• Tie each key to a user and support revocation (soft-delete) so a leaked key is killable without touching others.

A workable row shape:

api_keys
  id          uuid
  user_email  text        -- who this key acts as
  label       text        -- "laptop", "ci", etc.
  prefix      text        -- first ~11 chars, safe to display
  key_hash    text unique -- sha256(plaintext), hex
  created_at  timestamptz
  last_used_at timestamptz
  revoked_at  timestamptz -- null = active

Generate

import { createHash, randomBytes } from "node:crypto";

export function generateApiKey() {
  const plaintext = `mk_${randomBytes(24).toString("base64url")}`;
  return {
    plaintext,                                   // return to the user ONCE
    prefix: plaintext.slice(0, 11),              // store + display
    keyHash: createHash("sha256").update(plaintext).digest("hex"), // store
  };
}