Authentication
The idcd MCP Server authenticates with an MCP token (prefix idcd_mcp_),
created from the dashboard. Plain API keys (sk_live_) are not accepted by
the MCP server — only idcd_mcp_ tokens (and, as a fallback, idcd_pat_
personal access tokens) pass the MCP authenticator.
Token types
| Type | Lifetime | Use case |
|---|---|---|
| Personal | 24 hours | Personal development |
| Workspace | 90 days | Team-shared access |
| Service | 90 days (auto-renewable) | Production / CI-CD integrations |
Note: every token expires within 90 days — there are no permanent tokens (decision D21).
Create an MCP token
- Sign in to the idcd dashboard
- Navigate to Settings → MCP Tokens
- Click Create token, choose the type (and, for Service tokens, an IP whitelist)
- Copy the token — the plaintext is shown only once
Use the token
Authorization header
The MCP server reads the token from the standard bearer header:
Authorization: Bearer idcd_mcp_xxxxxxxx
Environment variable (recommended)
export IDCD_MCP_TOKEN=idcd_mcp_xxxxxxxx
Command-line flag
mcp --token idcd_mcp_xxxxxxxx
Scope
An MCP token grants access to the idcd MCP probe tools. Usage is counted against your plan's unified quota. Revoking a token takes effect immediately.