API keys and authentication

The remote MCP endpoint must not be public. QuickVoice MCP authenticates every request with the caller's organization-scoped QuickVoice API key, then forwards that key to the existing QuickVoice API layer.

Create a key

  1. Open the QuickVoice console.
  2. Go to Settings → API keys.
  3. Create a new key. New keys are organization-scoped and MCP-ready by default for trusted automation.
  4. Copy the key once and store it in your secret manager.

Required environment

  • QUICKVOICE_API_BASE_URL: server API base URL including the API version prefix, for example https://api.quickvoice.co/api/v1.
  • PORT or MCP_PORT: HTTP port for apps/mcp-server. The default is 8787.
  • MCP_ENDPOINT_PATH: endpoint path. The default is /mcp.
  • MCP_CORS_ORIGINS: optional comma-separated browser origins allowed to call the MCP endpoint.

Client header

Send the copied key on every MCP request with x-api-key. The MCP server also accepts Authorization: Bearer <key> for client compatibility, but x-api-key is the canonical QuickVoice header.

Rotation checklist

  1. Create a new QuickVoice API key in the console with the same or narrower permissions.
  2. Update the MCP client secret/configuration.
  3. Update client configuration and verify the MCP handshake.
  4. Revoke the old API key after all clients are migrated.