An MCP tool asks the user for an API key. How should the host handle it?

Instruction: Explain where credentials belong and how the workflow verifies that setup finished.

Context: A connected service needs a credential before it can complete the requested task.

Updated

Example Answer

I’d keep the key out of chat, model context, and ordinary tool arguments. Under MCP 2026-07-28, form elicitation must not request credentials; sensitive setup uses URL mode. The host shows which server requested it, the full destination URL with its domain highlighted, and a clear option to decline.

I’d reject URLs carrying credentials, personal data, or pre-authenticated access, and never prefetch them. I’d open an approved secure page that the client and model cannot inspect, then bind verified setup completion to the same authenticated user. Accepting the navigation request only means the user agreed to open that interaction. It does not prove that a key was saved or that the external service authorized access.

Concrete example

For a reporting integration, the user enters the key on the service’s secure setup page. A canceled setup leaves the report pending; it never prompts the user to paste the key into the conversation.

Follow-up to practice

Why is URL elicitation separate from authorizing the MCP client itself?

Reference

MCP 2026-07-28: elicitation

Your preparation path

Work through these questions in order. Read the answer aloud, then explain it in your own words.

1. Start with the foundations

Build the vocabulary and explain the core decisions.

  1. When should a model call a tool instead of answering from context? Free sample
  2. How would you explain MCP to a product engineer in one minute? Free sample
  3. What information should the orchestrator validate before executing a tool call? Free sample

2. Apply it to a real workflow

Practice diagnosis, validation, and everyday tradeoffs.

  1. Why do idempotency and retries matter more with AI-driven tool use? Free sample
  2. How do you keep permission boundaries clear when many tools share overlapping capabilities? Member answer
  3. A user revokes access to a connected app mid-session. How should the AI workflow behave? Member answer

3. Prepare for senior discussions

Explain failure boundaries, recovery, and production choices.

  1. Design a fallback strategy when tools are unavailable, degraded, or unauthorized. Member answer
  2. How do you implement MCP step-up authorization without losing scopes or retrying forever? Member answer
  3. An MCP request resumes after user confirmation. How would you validate its requestState? Member answer

Related Questions