How to Give Claude Secure Access to Your API Keys

Pasting a real API key into an MCP config file means a long-lived secret in plaintext on every machine that runs Claude — unrevocable except by rotating it everywhere. Here are three ways to give Claude the access without the paste, ordered by how often you'll want each. All three end the same way: the credential lives on your webhook, and access is scoped, revocable, and audited per agent.

New here? The Quickstart sets up the vault these paths assume (~10 minutes).

Option 1 — OAuth 2.1: no key anywhere (recommended)

Claude connects to Token Vault's MCP endpoint as a standard OAuth 2.1 client. No key is created, copied, or stored:

claude mcp add --transport http token-vault https://api.tokenvault.uk/api/agents/mcp
# then: /mcp → Authenticate → browser opens → pick which agent identity Claude binds to → done

Claude discovers the authorization server from a 401, registers itself dynamically, and walks away with a one-hour session token. Suspend the agent in the dashboard and Claude's session dies at its next refresh. Works in Claude.ai's connectors too. Details: OAuth 2.1 for MCP Clients.

Once connected, Claude has two tools: list_credentials (see its grants) and get_credential (fetch one, delivered directly from your webhook). Reference: MCP Endpoint.

Option 2 — MCP proxy: Claude never sees the key at all

For upstream MCP servers that need auth (GitHub, Slack, Linear…), don't give Claude the credential in any form — give it a proxy URL:

{
  "mcpServers": {
    "github": {
      "url": "https://api.tokenvault.uk/api/proxy/mcp?key=mcp_…",
      "headers": {}
    }
  }
}

Token Vault authenticates the mcp_… key and forwards each request to your webhook, which injects the real token server-side and calls the upstream. Claude holds only a random, one-click-revocable proxy key. Reference: MCP Proxy Endpoint.

Option 3 — Agent key: for scripts and headless use

For code Claude writes or runs headless (CI, cron), create an agent, grant it specific tokens with an expiry, and fetch on demand:

curl -sL "https://api.tokenvault.uk/api/agents/credentials?service=github" \
  -H "Authorization: Bearer tvagent_…"

The -L follows Token Vault's 307 redirect to your webhook, which serves the credential directly. One environment variable (tvagent_…) replaces every raw secret the script would otherwise embed — and it grants only what you granted, until you revoke it. Reference: Agent Credentials API.

Locking it down further

Attach ABAC policies to the agent: office-hours time windows, IP allowlists for your CI runners, rate limits, or manual approval — Claude's credential request pushes an approve/deny prompt to your phone before anything is released.