MCP

API keys for CI and scripts: use ProductEcho without OAuth

Create an MCP API key for a CI pipeline or script that cannot sign in through a browser, send it in a header, keep it secret and revoke it.

Updated November 10, 2026

When you need an API key

An MCP API key lets a CI job, a script or a server use ProductEcho's MCP server without a browser sign-in. For your own coding agent, sign in through the browser instead.

	Browser sign-in	API key
Used by	Your coding agent	CI jobs, scripts, servers
Acts as	You, with your workspace role	The workspace, not a person
Can do	What your role allows	Everything, including deploy and delete
Lasts	Renews while used; sign in again after 30 days without use	Until it expires or you revoke it
Who sets it up	Anyone who is a Developer, Admin or Owner	Owners and admins, on the Team page

Create a key

Open the Team page

Generate a key

Select Generate MCP key. Say what the key is for, such as GitHub Actions deploy. Optionally set Expires in days, from 1 to 365. Left empty, the key does not expire.

Store it as a secret

Copy the pe_live_... value into your CI provider's secret store, for example as PRODUCTECHO_API_KEY.

Your plan sets how many active keys a workspace can have.

Use the key

Send the key with every request to https://api.productecho.com/mcp, in the PRODUCT-ECHO-API-KEY header. Authorization: Bearer pe_live_... works too.

With Claude Code on a CI runner, add the server with the header. The shell fills in the key from the secret:

bash

claude mcp add --transport http productecho https://api.productecho.com/mcp \
  --header "PRODUCT-ECHO-API-KEY: $PRODUCTECHO_API_KEY"

A client that only starts local servers can send the header through mcp-remote:

mcp_config.json

{
  "mcpServers": {
    "productecho": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.productecho.com/mcp",
        "--header",
        "PRODUCT-ECHO-API-KEY: pe_live_YOUR_API_KEY_HERE"
      ]
    }
  }
}

Never paste a key into a prompt

Treat a key like a password. Keep it in a secret store or a local config file, never in an agent chat, a prompt or a repository.

Rotate and revoke keys

One key per job. Give each pipeline its own key with a clear purpose, so you can revoke one without breaking the others.
Set an expiry. A key that expires on its own limits the damage if it leaks. Create the new key before the old one expires.
Revoke on the Team page. Each key shows its purpose and when it was last used. A revoked key stops working at once.

Limits

A key has every permission, including deploy and delete. There are no read-only keys and no keys limited to one app or database.
A key belongs to the workspace, not to a person. It keeps working when the person who created it leaves the team.
Only owners and admins can create, rename or revoke keys.

Questions

Can I use an API key in Claude Code or Cursor on my laptop?+

It works, but the browser sign-in is the better choice there. It acts as you with your role and renews itself, while a key has full access until it expires or is revoked.

Can I make a read-only key?+

No. Every key has full access to the workspace.

What happens when a key expires?+

Requests that use it are refused with a 401 error. Create a new key and replace the value in your secret store.