Was this page helpful?
API & Keys
Zephex uses two authentication layers: dashboard login (email/password or OAuth) for the web UI, and API key Bearer tokens for MCP tool calls. This page covers both, plus MFA, sessions, and hardening.
Every tool call carries the same Bearer token. The proxy validates it before any tool executes.
Every MCP tool call requires a valid API key in the Authorization header:
Authorization: Bearer mcp_prod_cosmic-1861.a7f3b9c2d1e4...Plaintext API keys are shown exactly once at creation time. They are never stored, logged, or retrievable after that moment.
| Format | Example prefix | Notes |
|---|---|---|
| Legacy | mcp_sk_88d32efe... | Older keys, still valid |
| Current | mcp_prod_cosmic-1861.a7f3... | Environment-tagged, human-readable prefix |
The prefix (before the dot) is stored in plaintext for display purposes. The secret (after the dot) is hashed. You can identify which key made a request by its prefix without exposing the secret.
CLI-based MCP clients (Claude Code, Kiro CLI, Gemini CLI) can authenticate using OAuth 2.1 with PKCE. This avoids storing long-lived API keys on disk.
1. Client requests authorization GET /functions/v1/authorization-endpoint ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri=http://localhost:PORT/callback &code_challenge=BASE64URL(SHA256(verifier)) &code_challenge_method=S256 2. User authenticates in browser 3. Callback receives authorization code GET /callback?code=AUTH_CODE 4. Client exchanges code for token POST /functions/v1/token-endpoint grant_type=authorization_code &code=AUTH_CODE &code_verifier=ORIGINAL_VERIFIER &redirect_uri=http://localhost:PORT/callback/.well-known/oauth-authorization-server| Failed attempts | Action | Duration |
|---|---|---|
| 5 in 15 minutes | Account locked | 15 minutes |
| 10 in 1 hour | Account locked | 1 hour |
| 20 in 24 hours | Account locked + email alert | 24 hours |
Lockout applies to the account, not the IP. This prevents credential stuffing while allowing legitimate users on shared networks. A security alert email is sent on the third lockout tier.
Signup with disposable/temporary email providers (mailinator, guerrillamail, etc.) is blocked. This prevents abuse of the free tier through mass account creation. If your legitimate email domain is incorrectly blocked, contact support@zephex.dev.
Found a security issue? Email support@zephex.dev with reproduction steps. We respond within 48 hours and do not pursue legal action against good-faith security researchers.