API Tokens for MCP

Overview

MCP API tokens provide read-only access to your NOFire AI data for IDE integrations (Cursor, Claude Desktop) and developer tools. They let you query production Knowledge, assess deployment risk, and investigate incidents - all without dashboard switching. What MCP tokens can do:

Query production entities and services
Assess deployment risk for code changes
Analyze blast radius and dependencies
View change history and recent deployments
Investigate incidents and service relationships

What MCP tokens CANNOT do:

Modify production infrastructure
Trigger deployments or rollbacks
Change system configurations
Execute commands in clusters

MCP tokens are read-only, they cannot modify infrastructure, trigger deployments, or execute commands.

Generating an MCP API Token

Navigate to Administration

Create New API Token

Click Create API Token button

Create API Token form with MCP type selected

Fill in the details:

Name: Descriptive name (e.g., “john-cursor-dev”, “sarah-claude-desktop”)
Type: Select MCP

Use descriptive names: developer-tool-purpose format makes key management easier. Examples: alice-cursor-dev, ci-pipeline-staging

Copy the API Token

Important: The token is shown only once!

API Token created with copy button and security warning

Click Copy Token and save this securely. You’ll need it for IDE configuration.

Store this key securely! It cannot be retrieved later. If lost, you’ll need to generate a new key.

Configure Your IDE

Use the key in your MCP configuration:

{
  "mcpServers": {
    "NOFireAI": {
      "url": "https://mcp.nofire.ai",
      "transport": "http",
      "headers": {
        "X-API-Key": "your-mcp-key-here"
      }
    }
  }
}

API Token Management

Viewing API Tokens

In your dashboard under Administration → API Tokens, you can see:

Key Name: The descriptive name you provided
Key Type: agent or mcp
Status: Enabled or Disabled
Created: When the key was generated
Last Used: Last successful authentication

The full API token is never displayed after initial creation for security reasons.

API Tokens list showing enable/disable toggle and delete button

Deactivating API Tokens

You can temporarily deactivate tokens without deleting them:

Go to Administration → API Tokens
Find the key you want to deactivate
Click the toggle to change stEnabled or Disabled**

When to deactivate:

Employee leaving the team
Suspicious activity detected
Rotating keys as security practice
Temporarily disabling integration

Deleting API Tokens

Permanently remove API tokens:

Go to Administration → API Tokens
Click the Delete button next to the key
Confirm deletion

When to delete:

Key compromised
Integration no longer used
Replacing with new key

Deletion is immediate and irreversibleAny services using this key will immediately lose access. Make sure to update configurations before deleting production keys.

Security Best Practices

Use Separate Keys Per Developer

Create individual MCP tokens for each team member:

✅ Good:
- john-cursor-dev
- sarah-claude-desktop
- alex-vscode

❌ Bad:
- team-shared-key
- engineering-mcp

Benefits:

Track individual usage
Revoke access per person
Audit who made what queries

Separate Keys for Different Purposes

Use different keys for different purposes:

✅ Good:
- backend-ci-pipeline
- frontend-ci-pipeline
- developer-ide-john
- automation-scripts

❌ Bad:
- company-master-key

Benefits:

Limit blast radius of compromised keys
Track usage by purpose
Easier to rotate specific keys

Never Commit Keys to Git

Never store API tokens in:

Git repositories
Docker images
Configuration files in version control
Public documentation

Instead, use:

Environment variables
Secret management systems (encrypted vaults, secret stores)
CI/CD secret storage (GitHub Secrets, GitLab CI/CD variables)
Local config files in .gitignore

Add patterns to .gitignore:

# NOFire AI keys
.cursor/mcp.json
claude_desktop_config.json
**/nofireai.key

Rotate Keys Periodically

Implement key rotation as security practice:Recommended schedule:

Developer IDE keys: Every 6 months
CI/CD pipeline keys: Every 3 months
Shared automation keys: Every month
Compromised keys: Immediately

Rotation process:

Generate new key with temporary name
Update all configurations to use new key
Test everything works
Deactivate old key (not delete!)
Monitor for 24-48 hours
Delete old key if no issues

Monitor Key Usage

Regularly review key usage in your dashboard:Check for:

Keys not used in 30+ days (consider deactivating)
Unexpected usage patterns
Failed authentication attempts
Keys used from unusual locations

Set up alerts for:

Multiple failed authentication attempts
API token used from new IP address
Unusual query volume

Store Keys Securely Locally

On your local development machine:macOS/Linux:

# Restrict file permissions
chmod 600 ~/.cursor/mcp.json
chmod 600 ~/Library/Application\ Support/Claude/claude_desktop_config.json

Windows: Use NTFS permissions to restrict access to your user account only.Additional protection:

Use full-disk encryption
Lock computer when away
Use password manager for key storage
Enable 2FA on NOFire AI dashboard

API Token Security

NOFire AI API tokens are designed with security in mind:

Unique Identifiers: Each key is cryptographically unique and securely hashed
Type-Based Permissions: Keys have fixed permission levels based on their type (MCP tokens are always read-only)
Account Isolation: Keys are scoped to your specific account and cannot access other accounts’ data
Secure Storage: Keys are stored in an encrypted secret store using industry-standards.

Never share your API tokens publiclyAPI tokens provide access to your NOFire AI data. Treat them like passwords. Store them securely and never commit them to version control or share them in public channels.

Using Your MCP Key

Once generated, use your MCP token in your IDE configuration:

For Cursor or Claude Desktop

{
  "mcpServers": {
    "NOFireAI": {
      "url": "https://mcp.nofire.ai",
      "transport": "http",
      "headers": {
        "X-API-Key": "your-mcp-key-here"
      }
    }
  }
}

Full IDE setup guide →

Troubleshooting

Invalid API Token Error

Error: 401 Unauthorized - Invalid API tokenPossible causes:

Key was copied incorrectly (missing characters)
Key has been deactivated or deleted
Using wrong key type for operation
Key has expired or been revoked

Solutions:

Re-copy key from secure storage (check for spaces or line breaks)
Verify key is active in dashboard
Ensure you’re using an MCP token (not an agent key)
Generate a new key if the old one is lost or compromised

Permission Denied

Error: 403 Forbidden - MCP tokens are read-onlyCause: Attempting a restricted operation with an MCP tokenSolution: MCP tokens are read-only and can only query and analyze data. They cannot modify production systems, trigger deployments, or change infrastructure.

Rate Limiting

Error: 429 Too Many RequestsCause: Exceeded API rate limitsCurrent limits:

100 requests per minute per key
1000 requests per hour per account

Solutions:

Implement exponential backoff
Cache results when possible
Distribute load across multiple keys
Contact support for higher limits

FAQ

How many MCP tokens can I create?

No hard limit. Create as many keys as needed for your organization. Best practice is one key per developer/tool.

Do MCP tokens expire?

No, MCP tokens don’t automatically expire. However, we recommend rotating them periodically as a security best practice (every 6 months for developer keys).

Can I see what my key has been used for?

Yes. The dashboard shows:

Last used timestamp
Total requests made
Failed authentication attempts

For detailed audit logs, contact enterprise support.

Can I use one key for multiple IDEs?

Technically yes, but not recommended. Create separate keys for:

Each developer
Each IDE/tool
Each CI/CD pipeline

This makes it easier to track usage and revoke access if needed.

What happens if my key is compromised?

Take these steps immediately:

Deactivate the compromised key in the dashboard
Generate a new MCP token
Update your IDE configuration with the new key
Review usage logs for suspicious activity
Contact [email protected] if you suspect unauthorized access

Impact of compromise:

✅ Cannot modify infrastructure, deploy changes, or execute commands
⚠️ Can query service topology, dependencies, and change history
⚠️ Can access operational metadata (service names, deployment patterns)
⚠️ Could reveal architecture details to attackers

Treat as P2 incident: While less severe than write-access compromise, a leaked MCP token still exposes operational intelligence. Rotate immediately.

I see 'agent' keys in the dashboard. What are those?

Agent keys are used by the NOFire AI Kubernetes agent to send data to NOFire AI.For IDE use, you need MCP tokens (this guide). Agent keys are for infrastructure data ingestion only.

What’s Next?

Getting Started with MCP

Set up MCP integration in your IDE

Proactive Reliability

Learn about shift-left features

Security

Understand our security model

FAQ

Common questions and answers

Get Started

Setup & Integrations

Security

API Tokens for MCP

Overview

Generating an MCP API Token

API Token Management

Viewing API Tokens

Deactivating API Tokens

Deleting API Tokens

Security Best Practices

API Token Security

Using Your MCP Key

For Cursor or Claude Desktop

Troubleshooting

FAQ

What’s Next?

Getting Started with MCP

Proactive Reliability

Security

FAQ

Get Started

Setup & Integrations

Security

​Overview

​Generating an MCP API Token

​API Token Management

​Viewing API Tokens

​Deactivating API Tokens

​Deleting API Tokens

​Security Best Practices

​API Token Security

​Using Your MCP Key

​For Cursor or Claude Desktop

​Troubleshooting

​FAQ

​What’s Next?

Getting Started with MCP

Proactive Reliability

Security

FAQ

Overview

Generating an MCP API Token

API Token Management

Viewing API Tokens

Deactivating API Tokens

Deleting API Tokens

Security Best Practices

API Token Security

Using Your MCP Key

For Cursor or Claude Desktop

Troubleshooting

FAQ

What’s Next?