Move your Firecrawl API key out of shared MCP config files
You will find where the Firecrawl API key appears in shared MCP configuration and move it to private storage. This matters because a key sitting in a shared file can be copied, committed, or exposed, and a leaked key can drain your quota and billing.
- Find config filesLocate every MCP file that defines the Firecrawl server
- Replace keyIssue a new key and revoke the old one
- Move key to private storageKeep the value out of shared config
- VerifyRestart the client and run one test request
Why it matters
The firecrawl-mcp-server directory entry notes that the server requires storing FIRECRAWL_API_KEY in config files, and that a compromised key exposes quota and billing to attackers (firecrawl-mcp-server on GitHub (opens external site)). A key pasted into a shared MCP config can end up in a git commit, a dotfiles repo, or a screenshot in a support thread. Once that happens, anyone with the file can use your account.
Steps
-
Find every MCP config file where the Firecrawl server is defined. Check the setup for each client you use, such as Claude or Cursor, and any MCP file kept inside a project repo. The directory entry does not say where these files live, so confirm the location in each client's own documentation.
-
Open each file and look for a literal key value next to FIRECRAWL_API_KEY. If you find one, treat that key as exposed and plan to replace it.
-
Create a new Firecrawl API key in your account and revoke the old one. Confirm the old value no longer works before you consider the leak closed.
-
Store the new key in a local environment setting or a secret manager your OS or team already uses. Keep it out of any file that gets committed or shared.
-
Check the official firecrawl-mcp npm project page for how the server expects to receive the key, and follow its documented method. The directory entry does not show the exact syntax, so describe the change in words rather than guessing a format.
-
Add any local-only config file to .gitignore, and search your git history for the old key value before you push.
-
Restart your MCP client and run one small Firecrawl request to confirm the new key works.
Common mistakes
- Deleting the line without replacing the key. The old value was already readable, so it still needs to be revoked.
- Committing a project-level MCP file that still contains the key, even in a private repo.
- Pasting the key into a chat or ticket to debug a config error.
- Installing the package from an unverified source. Check the official npm project page first, as the directory suggests.
Checklist
0 of 8 done