Connect with an API key

MCP clients that support a manually configured bearer token can authenticate with a normal Upscrape API key.

Configuration

Use the MCP URL:

https://data.upscrape.com/mcp

Send the API key as:

Authorization: Bearer UPSCRAPE_API_KEY

The endpoint uses Streamable HTTP and expects JSON-RPC requests over HTTP POST.

When to use this path

API-key authentication is appropriate for a trusted development tool, internal service, or client that cannot complete OAuth discovery and authorization.

Prefer OAuth for third-party consumer connectors. Copying a long-lived API key gives the client direct account access and makes independent revocation and consent harder to reason about.

Key handling

• Put the key in the client's protected secret field, not in the server URL.
• Do not include it in query parameters.
• Use a dedicated key when possible so it can be revoked independently.
• Never paste a real key into a support request or an agent conversation.

Permissions

The existing mcp, execute and jobs:read permissions govern discovery, scraping and job reads. Account snapshots require account:read; feedback submission and status require feedback:write and feedback:read. Collections require collections:read with jobs:read, or collections:write with execute. No special profile URL is required. Existing stored keys keep their permissions. Use a dedicated key with only the permissions the client needs. Platform and capability allowlists also apply to job history and referenced feedback diagnostics.