Hacker News new | ask | show | jobs
by block_dagger 200 days ago
Embedding the API key (secret) in the URL complicates secret management. Please move that to a header and allow setting via env var.
1 comments

Hi, thanks for the feedback. We actually already support `Bearer: Authorization <token>` auth scheme. It is accessible on https://mcp.serpapi.com/mcp path.

I would say the /apiKey/mcp integration path is more tailored for manual Claude Desktop / VS Code users where it might be easier, than trying to insert headers somehow.

Regarding the environment variables, the MCP is stateless so the secret management is handled on the client and obviously it could be set via env vars.