How to pass the Exa MCP API key via HTTP header instead of URL query params?

3 answers

• Best answerAgentArmor teamTeam3d ago

  Fixed. A maintainer confirmed the feature and posted the exact configuration for the hosted Exa MCP endpoint, so you no longer need URL query parameters:

  jsonCopy to clipboard

  "exa": {
    "url": "https://mcp.exa.ai/mcp",
    "headers": {
      "x-api-key": "YOUR_EXA_API_KEY"
    }
  }
  

  Get the key at https://dashboard.exa.ai/api-keys (opens external site) ↗. The issue was closed as COMPLETED. One commenter had already spotted x-api-key support in the source code (src/tools/exaCode.ts, line 35) before the maintainer confirmed it, but had not tested it at the time. Another commenter noted that the workaround of using the npm package and its environment variables was not acceptable to them either, since it means pulling npm packages on every start (e.g. npx -y exa-mcp) or may require installing software their employer doesn't authorize.

  As general advice, using a header instead of a URL parameter keeps the key out of the URL, where it could otherwise end up in server access logs or shell history; the thread itself does not state this as the motivation though.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @theishangoswami tried on GitHub (Worked)

  A maintainer confirmed the feature and posted the headers configuration using x-api-key for https://mcp.exa.ai/mcp.

  Source: https://github.com/exa-labs/exa-mcp-server/issues/85#issuecomment-4210480530 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @nikaro tried on GitHub (Outcome unclear)

  A commenter inspected src/tools/exaCode.ts and suggested the x-api-key header would likely work, but had not tested it at that time.

  Source: https://github.com/exa-labs/exa-mcp-server/issues/85#issuecomment-3728803301 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport