MCP server API key vs OAuth: which one to use

When a remote MCP server supports both, use OAuth in an interactive client someone sits in front of, and use an API key for scripts, CI, and headless runs where nobody can click through a sign-in page. With OAuth, a person approves access in a browser and the client keeps the token; with an API key, the client sends the same static header on every request.

Client behavior comes from the Claude Code MCP docs and Cursor's MCP docs; the example server is Sume's hosted MCP server, from MCP OAuth and API keys. All were read on 2026-09-28. If you meant "MCP or a plain API call?", see MCP vs REST API.

What changes between OAuth and an API key?

More than the header. On Sume's server the two are not interchangeable credentials, and they open different tool sets:

How do I add an MCP server with an API key header?

Pass the header when you add the server, and reference the key through a variable instead of pasting it. Where API keys go in an MCP config shows each client's variable syntax, and MCP server needs authentication in Claude Code has the claude mcp add --header command.

Know what the key unlocks before you choose it. A Sume API key belongs to one workspace, which Sume resolves from the key. An API-key session sees write and paid tools with no consent step, so what's left is the workspace wallet and per-call gates: every mutating or paid call needs an idempotency_key, dry_run=true previews the cost first, and max_spend_usd caps a call only when you pass it.

Can I use an MCP server without an API key?

Yes, if it supports OAuth. Add the server by URL with no header, then sign in: in Claude Code with /mcp or claude mcp login <name>, and in Cursor through the prompt it shows. Claude Code's docs note OAuth works with HTTP servers.

On Sume, consent shows Read locked on and a Write toggle that defaults to off. Leave Write off to browse the catalog, jobs, and assets; turn it on when the agent should generate, since paid tools return insufficient_scope without it. There is no separate paid scope.

Which should I use for CI or claude -p?

An API key: Claude Code's docs say that in non-interactive mode there is no /mcp panel, so it can't run the OAuth flow for you, and MCP server needs authentication in Claude Code covers the rest of that case.

How do I keep each credential safe?

Sume's docs set these rules for both:

• Keep API keys on trusted servers, CI secret stores, or developer machines, never in frontend JavaScript, mobile apps, or screenshots.
• Don't paste API keys into chat; prefer the OAuth connector flow in interactive clients.
• An MCP OAuth token is not a Sume API key: don't paste it into prompts or store it in CLI config, and don't mint API keys for OAuth clients as a workaround.
• Rotate a key from the dashboard if it appears in logs or chat history.