Changelog

Optional API Key Enforcement for MCP Servers

We’ve introduced a new project-level security setting that allows you to require API key authentication for all MCP server requests. This opt-in feature gives you fine-grained control over who can access your MCP endpoints.

What’s New

A new “Require API Key for MCP” toggle is now available in your Project Settings. When enabled, all requests to your MCP servers must include a valid Composio API key in the request headers.

How It Works

When the setting is disabled (default):

• MCP servers work without API key authentication
• Existing integrations continue to function unchanged

When the setting is enabled:

• All MCP requests must include the x-api-key header with a valid Composio API key
• Requests without a valid API key receive 401 Unauthorized
• Only API keys belonging to the same project are accepted

Request Examples

Without API key (when enforcement is enabled):

$
curl -X POST "https://mcp.composio.dev/{your_mcp_server_url}" \
>
  -H "Content-Type: application/json" \
>
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'
>
>
# Response: 401 Unauthorized

With API key:

$
curl -X POST "https://mcp.composio.dev/{your_mcp_server_url}" \
>
  -H "Content-Type: application/json" \
>
  -H "x-api-key: ak_your_api_key" \
>
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'
>
>
# Response: 200 OK

Enabling the Setting

Via Dashboard

1. Navigate to Project Settings
2. Go to the Project Configuration tab
3. Find the “Require API Key for MCP” toggle
4. Enable the toggle

Via API

Update your project configuration using the API:

$
curl -X PATCH "https://backend.composio.dev/api/v3/org/project/config" \
>
  -H "Content-Type: application/json" \
>
  -H "x-api-key: ak_your_api_key" \
>
  -d '{"require_mcp_api_key": true}'

Response:

1
{
2
  "require_mcp_api_key": true,
3
  "is_2FA_enabled": true,
4
  "mask_secret_keys_in_connected_account": true,
5
  "log_visibility_setting": "show_all"
6
}

Via Code

1
import requests
2
3
response = requests.patch(
4
    "https://backend.composio.dev/api/v3/org/project/config",
5
    headers={
6
        "Content-Type": "application/json",
7
        "x-api-key": "ak_your_api_key"
8
    },
9
    json={"require_mcp_api_key": True}
10
)
11
12
print(response.json())

When to Use This

Enable API key enforcement when you need to:

• Prevent unauthorized access to your MCP servers
• Control which applications can interact with your MCP endpoints
• Add an extra security layer for production deployments
• Audit and track MCP server usage through API key attribution

API Reference

Get Current Setting

1
GET /api/v3/org/project/config

Update Setting

1
PATCH /api/v3/org/project/config

1
{
2
  "require_mcp_api_key": true
3
}