API & Keys
API keys authenticate every request to the Zephex MCP endpoint. Create separate keys per environment, rotate them regularly, and revoke instantly if one is exposed.
Create keys from Dashboard → API Keys. Each key is shown once at creation — copy it immediately. The dashboard only stores an HMAC-SHA256 hash with a per-key salt after that point, so the plain-text key cannot be retrieved later.
KEY FORMAT
Keys follow the pattern: mcp_<env>_{word}-{number}.{secret}
Examples:
• mcp_dev_local-01.abc123... — development
• mcp_prod_api-01.xyz789... — production
Use separate keys for local development, staging, and production. If a development key leaks in a commit, you revoke only that key without disrupting production. Each key inherits the rate limits from your plan — they share the same monthly quota.
To rotate a key: create a new key first, update your editor config to use the new key, verify the connection works, then revoke the old key. This ensures zero downtime during rotation.
Revocation is instant. Once revoked, any request using that key returns an authentication error immediately. There is no grace period. If you accidentally committed a key to git, revoke it and create a new one — do not assume the exposure window was too short to matter.
promptString input to avoid storing keys in config files