> ## Documentation Index
> Fetch the complete documentation index at: https://context7.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to your on-premise Context7 instance

The on-premise API supports API keys for server-to-server and MCP access. Pass the key in the `Authorization` header:

```bash theme={null}
Authorization: Bearer ctx7op-xxxxxxxx_xxxxxxxxxxxxxxxx
```

Keys are scoped to the user account that created them and inherit that user's role (`admin` or `member`). There are no per-key scopes or expiry - revoke a key to invalidate it.

## Creating an API Key

**1. Open Settings**

Go to **Personal Settings > API Keys** in the admin dashboard and click **Create API Key**.

![API Keys settings page](https://mintcdn.com/context7/QUibka_ee7a5f8KO/images/enterprise/api-keys/api-keys-empty.png?fit=max\&auto=format\&n=QUibka_ee7a5f8KO\&q=85\&s=9d50ab6fea00e6ff4266da7f626c81ef)

**2. Name the key**

Give the key a descriptive name so you know which client or service is using it (e.g. `CI pipeline`, `Cursor`).

![Create API Key dialog](https://mintcdn.com/context7/QUibka_ee7a5f8KO/images/enterprise/api-keys/api-keys-create-dialog.png?fit=max\&auto=format\&n=QUibka_ee7a5f8KO\&q=85\&s=a0d97c763d1f5c1f6a7d5b3f554620af)

**3. Copy the key**

Copy the full key value before closing the dialog. It is only shown once.

![API Key Created dialog showing the key value](https://mintcdn.com/context7/QUibka_ee7a5f8KO/images/enterprise/api-keys/api-keys-created.png?fit=max\&auto=format\&n=QUibka_ee7a5f8KO\&q=85\&s=c5593880c14f95fc0347f79cee0c8cde)

> [!WARNING]
>
> API keys are shown only once at creation. Store yours securely before closing the dialog.

## Revoking a Key

Go to **Settings > API Keys** and click the delete icon next to the key. Revocation is immediate and cannot be undone. Update any integrations using the key before revoking.

## Roles

| Role | Access |
| - | - |
| `admin` | Full access to all endpoints including settings, user management, and delete operations |
| `member` | Can trigger parsing and search. Cannot access admin endpoints |

Default credentials on a fresh install are `admin` / `admin`. Change them immediately from **Settings > Change Credentials**.

## Anonymous Access

Certain operations can be allowed without authentication. Configure them from **Settings > Permissions**:

| Permission | Default |
| - | - |
| Anonymous parse / refresh | Off |
| Anonymous delete | Off |

MCP authentication is configured separately in **Settings > Authentication**. When enabled, external requests to `/mcp`, `/api/v2/libs/search`, and `/api/v2/context` require a personal API key. When disabled, those endpoints allow anonymous access. The local MCP bridge can still call the v2 endpoints over loopback.

The legacy global `API_KEY` environment variable protects the broader HTTP API independently of personal MCP keys. New deployments should use dashboard users and personal keys for MCP clients.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.