API_KEYS.md

API Key Setup

Quick reference for provisioning madmcp's connector credentials. Click a button to jump straight to that provider's key-creation page, copy the generated value, then paste it into the server's env vars (Vercel/Render dashboard).

None of these providers support auto-injecting the key back into our env — you still copy/paste manually. This page just skips the "where do I even go" step.

---

GitHub — GITHUB_TOKEN

If you want the Codespaces tools (list_codespaces, create_codespace, etc.) to work, this PAT also needs the codespace scope checked — it's not implied by the repo scopes you'd otherwise pick. A 403/insufficient-scope response from those tools means the token needs to be reissued with it added.

Cloudflare — CLOUDFLARE_API_TOKEN

Cloudflare Account ID — CLOUDFLARE_ACCOUNT_ID

Not a key you create — just copy it from the account overview sidebar.

Notion — NOTION_TOKEN

Mem0 — MEM0_API_KEY

Gemini — GEMINI_API_KEYS

Comma-separated list — same reasoning as EXA_API_KEYS/OPENROUTER_API_KEYS/GROQ_API_KEYS above (rate-limit headroom + account isolation). The connector cascades through GEMINI_MODEL + GEMINI_FALLBACK_MODELS on the current key first, and only rotates to the next key once every model on the current one is exhausted or the key itself is rejected (401/403). The legacy singular GEMINI_API_KEY still works if you only have one key — GEMINI_API_KEYS just wasn't set yet.

Exa — EXA_API_KEYS

Comma-separated list — you can generate multiple keys and combine them.

OpenRouter — OPENROUTER_API_KEYS

Comma-separated list — same reasoning as EXA_API_KEYS above (rate-limit headroom + account isolation). Backs the optional provider: "glm" mode of delegate_agent (GLM via OpenRouter) — leave unset to stick with the default Gemini provider.

Groq — GROQ_API_KEYS

Comma-separated list — same reasoning as EXA_API_KEYS/OPENROUTER_API_KEYS above. Backs the optional provider: "groq" mode of delegate_agent — free-tier request/token-rate-limited rather than credit-balance-gated (unlike OpenRouter/GLM), so it's the practical free alternative while provider: "glm" is blocked on account credit. Leave unset to stick with the default Gemini provider.

B.AI — BAI_API_KEYS

Comma-separated list — same reasoning as EXA_API_KEYS/OPENROUTER_API_KEYS/GROQ_API_KEYS above (rate-limit headroom + account isolation). Backs the optional provider: "bai" mode of delegate_agent — key-rotation-only cascade over multiple keys with deliberately NO model-fallback cascade, currently wired to the free GLM-5.3-Flash model only. Leave unset to stick with the default Gemini provider.

Context7 — CONTEXT7_API_KEY (optional)

Works unauthenticated at low rate limits — only provision this if you're hitting limits.

Jules — JULES_API_KEY

Unlike Context7, there's no unauthenticated tier — required for any jules_* tool to work. Max 3 keys per account. Alpha API per Google's own docs, so endpoint shapes may change without notice.

Upstash Redis / Vercel KV — UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN (or KV_REST_API_URL + KV_REST_API_TOKEN) (optional)

Optional — persists per-model rate-limit cooldowns (shared across Gemini, GLM, Groq, and B.AI) and delegate_agent resume checkpoints across calls. Fails open (no cross-call memory, but nothing breaks) if unset. On Vercel, easier to add via Storage → Create Database → Upstash for Redis (Marketplace integration) instead of the link above — either path works, just note which var names your integration hands you (the two naming pairs above are interchangeable, connectors/shared/cooldown.js accepts either).

MCP_SHARED_KEY — your own secret (not a provider credential)

This one isn't issued by any provider — it's just a long random string you make up yourself, used to lock down this server's /mcp endpoint. The badge above is a small third-party generator (the same one NextAuth's own docs point to) that generates the string client-side and shows it to you to copy. If you'd rather not depend on an external site, run this locally instead — it never leaves your machine:

openssl rand -hex 32

---

⚠️ Advanced: GitHub App credentials

GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, GITHUB_APP_PRIVATE_KEY

This isn't a single key — it's a multi-step flow:

1. Create the App at the link above.
2. Install it on the target repo/org to get the Installation ID.
3. Generate and download a private key (.pem) from the App settings page.
4. Copy the App ID from the App's general settings.

---

Where to paste these

Set each value as an environment variable in the deployment platform's dashboard (Vercel Project Settings → Environment Variables, or Render's dashboard for render.yaml-based services). All connector tokens are optional at startup — missing ones just disable that connector's tools rather than crashing the server.