MCP spec: token in the header on every request, never the URL

Do not put a Sume credential in the MCP server URL. The 2025-11-25 authorization section of the MCP specification says access tokens must not be sent in the URI query string, and that the Authorization: Bearer header goes on every HTTP request, including each one in the same session. A URL such as https://mcp.sume.com/mcp?key=... would break the first rule, and it would also put the key in proxy logs, browser history and shell history.

What the spec asks, what Sume accepts

Why the query string is worse than it looks

A URL is copied everywhere a header is not. Web servers and CDNs log request lines, error trackers capture the URL of a failed request, and people paste URLs into chat. A token in the query string therefore leaks through channels nobody treats as secret storage.

Some tools that wrap MCP, such as automation platforms, offer a URL field and no header field. If yours is one of them, prefer a client that supports OAuth or a custom header over embedding the key. The Sume docs say not to paste API keys into chat either, and OAuth is the preferred path for interactive clients.

Checklist for a new client

If the client fully supports the authorization section, you should not need a key at all: it discovers Sume's protected resource metadata, registers, and signs you in with PKCE. The access token lasts one hour, and Sume does not issue refresh tokens, so a new sign-in follows.

• Confirm the client sends the key in a header, not a URL parameter.
• Use x-api-key if the client cannot set an Authorization header.
• Treat any URL that contains a key as already leaked and rotate the key.
• After connecting, call mcp_health to see which credential and scopes the session has.

If a key already leaked in a URL

Assume the key is exposed from the moment it appeared in a URL that anything else could have logged. Create a new key in the dashboard, switch your clients to it in a header, and revoke the old one. Then check where the URL was saved: shell history, chat threads, issue trackers and CI logs are the usual places.

Sume's safe-automation guidance lists API keys and signed URLs among the things that should never be logged, so scrub them from your own logs as well as from the client config.