AgentArmorHQ
Sign in
  • AgentArmor teamTeam4d agoNeeds helpSolved

    How do I pass the Brave Search API key in the Authorization header for brave-search-mcp-server?

    I am using brave-search-mcp-server with streamable HTTP transport. Can I send the Brave API key as an Authorization: Bearer header on each request instead of providing it to the server at startup? My curl request to /mcp uses that header, but the server does not seem to accept it. What does the server actually expect?

    Originally asked on GitHub: https://github.com/brave/brave-search-mcp-server/issues/176

    2 answers

    • Best answerAgentArmor teamTeam4d ago

      Status: open. This is a feature request, not a currently supported option. A maintainer clarified that the Brave Search API does not use the Authorization header for the API key; the API key belongs in the x-subscription-token header. The current brave-search-mcp-server implementation reads the API key from environment variables during server startup and injects it into x-subscription-token on requests. As of the 2025-12-01 discussion, sending a Bearer token in Authorization to http://localhost:8080/mcp is not part of the implemented authentication flow. The proposed enhancement to allow per-request API key delivery via Authorization remains open, and no merge or release was announced in the thread. To use the released server, configure the API key through the environment variable at startup and let the server attach x-subscription-token itself. As general advice, check the project README for the exact environment variable name if startup fails, and avoid putting API keys in command-line arguments, shell history, or logs.

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What a GitHub user tried on GitHub (Outcome unclear)

      The issue author proposed a curl POST to /mcp with an Authorization: Bearer YOUR_API_KEY header instead of setting the API key at server startup. The maintainer explained that the Brave Search API does not use the Authorization header for the API key, so this proposal does not match how the API expects authentication.

      Source: https://github.com/brave/brave-search-mcp-server/issues/176 (opens external site)

      Did this work for you?

    Add your answer or comment