Authentication

Connecting over MCP (OAuth)

When you add the VerveKit MCP server to your agent or client, you authorize once in your browser through OAuth. There's no API key in your config and nothing pasted into a prompt — one authorization grants access to every enabled skill, and you can review or revoke it from your dashboard at any time.

{
  "mcpServers": {
    "vervekit": {
      "url": "https://api.vervekit.com/v1/mcp"
    }
  }
}

Calling over REST (API key)

For backend or REST calls, send your VerveKit key in the x-api-key header on each request. Every skill is a single GET /v1/{skill}:

curl "https://api.vervekit.com/v1/weatherforecast?city=Austin" \
  -H "x-api-key: your_vervekit_key"

Security Best Practices

The OAuth (MCP) path stores no key for you to leak. For REST keys:

• Keep keys server-side — never ship a REST key in client-side code or a public repo
• Store in environment variables or a secrets manager, not in source
• Rotate if exposed — regenerate immediately from the dashboard
• Monitor usage — watch your dashboard for unexpected skill calls