Claude Code plugin userConfig: prompt for the Sume API key once

Yes: a Claude Code plugin can prompt for the Sume API key when the plugin is enabled and place it in the MCP request header without writing it into a JSON file. Declare a userConfig option with sensitive: true, then reference it as ${user_config.sume_api_key} in the headers of the plugin's MCP server. The plugin reference says sensitive values go to the platform's secure credential store instead of settings.json.

This is the cleanest way to hand a team a Sume connector. Nobody pastes a key into a shared repo, and the manifest itself holds no secret. If you would rather use OAuth, leave the headers out entirely and Claude Code will run the sign-in flow against the same URL.

What the plugin reference says about userConfig

The table lists the parts of the manifest this setup relies on, as documented on the page read today.

A manifest that uses it

Save this as .claude-plugin/plugin.json. The plugin name sume-media is not one of the reserved prefixes the validator rejects.

{
  "name": "sume-media",
  "version": "0.1.0",
  "description": "Sume hosted MCP for image, video, audio and avatar jobs",
  "userConfig": {
    "sume_api_key": {
      "type": "string",
      "title": "Sume API key",
      "description": "Sent as a Bearer token to mcp.sume.com",
      "sensitive": true,
      "required": true
    }
  },
  "mcpServers": {
    "sume": {
      "type": "http",
      "url": "https://mcp.sume.com/mcp",
      "headers": {
        "Authorization": "Bearer ${user_config.sume_api_key}"
      }
    }
  }
}

Steps

Run claude plugin validate ./sume-media first. The validator errors on a ${user_config.KEY} reference to an option the manifest does not declare, so a typo in the key name is caught before anyone installs. Then enable the plugin; Claude Code asks for the key and stores it. Check the connection with the mcp_health tool and confirm the auth source reads as an API key.

• Use the exact option name on both sides, here sume_api_key.
• Keep the URL as https://mcp.sume.com/mcp.
• Create a separate Sume key per team or per environment so you can revoke one without touching the rest.

What this does not change on the Sume side

An API key gives the full hosted tool set. Sume's docs say write and paid tools still require an idempotency_key, and max_spend_usd is enforced only when the caller supplies it. A plugin prompt does not add a spend limit. If you want read-only discovery, connect with OAuth and keep the Write opt-in off: mcp:read hides the write and paid tools.

Sume also does not read your userConfig. It only sees the Authorization header that arrives. Rotating the key means updating the plugin option and revoking the old key in your Sume account.