mirror of
https://github.com/upstash/context7.git
synced 2026-09-14 19:09:34 +08:00
Fahreddin Özcan
e127fa124a
* CTX7-2006: feat(cli): support on-premise setup with base URL * CTX7-2006: refactor(cli): isolate on-prem setup from outbound services * CTX7-2006: feat(cli): prompt securely for on-prem API key * CTX7-2006: test(cli): isolate on-prem API key scenarios * CTX7-2006: fix(cli): harden on-premise setup * CTX7-2006: refactor(cli): tighten on-premise setup boundaries * CTX7-2006: fix(cli): address on-premise review feedback * CTX7-2006: chore(cli): release setup support as patch
67 lines
2.6 KiB
Plaintext
67 lines
2.6 KiB
Plaintext
---
|
|
title: "Authentication"
|
|
description: "How to authenticate requests to your on-premise Context7 instance"
|
|
---
|
|
|
|
The on-premise API supports API keys for server-to-server and MCP access. Pass the key in the `Authorization` header:
|
|
|
|
```bash
|
|
Authorization: Bearer ctx7op-xxxxxxxx_xxxxxxxxxxxxxxxx
|
|
```
|
|
|
|
Keys are scoped to the user account that created them and inherit that user's role (`admin` or `member`). There are no per-key scopes or expiry - revoke a key to invalidate it.
|
|
|
|
## Creating an API Key
|
|
|
|
<Steps>
|
|
<Step title="Open Settings">
|
|
Go to **Personal Settings > API Keys** in the admin dashboard and click **Create API Key**.
|
|
|
|
<Frame>
|
|
|
|
</Frame>
|
|
</Step>
|
|
<Step title="Name the key">
|
|
Give the key a descriptive name so you know which client or service is using it (e.g. `CI pipeline`, `Cursor`).
|
|
|
|
<Frame>
|
|
|
|
</Frame>
|
|
</Step>
|
|
<Step title="Copy the key">
|
|
Copy the full key value before closing the dialog. It is only shown once.
|
|
|
|
<Frame>
|
|
|
|
</Frame>
|
|
</Step>
|
|
</Steps>
|
|
|
|
<Warning>API keys are shown only once at creation. Store yours securely before closing the dialog.</Warning>
|
|
|
|
## Revoking a Key
|
|
|
|
Go to **Settings > API Keys** and click the delete icon next to the key. Revocation is immediate and cannot be undone. Update any integrations using the key before revoking.
|
|
|
|
## Roles
|
|
|
|
| Role | Access |
|
|
|---|---|
|
|
| `admin` | Full access to all endpoints including settings, user management, and delete operations |
|
|
| `member` | Can trigger parsing and search. Cannot access admin endpoints |
|
|
|
|
Default credentials on a fresh install are `admin` / `admin`. Change them immediately from **Settings > Change Credentials**.
|
|
|
|
## Anonymous Access
|
|
|
|
Certain operations can be allowed without authentication. Configure them from **Settings > Permissions**:
|
|
|
|
| Permission | Default |
|
|
|---|---|
|
|
| Anonymous parse / refresh | Off |
|
|
| Anonymous delete | Off |
|
|
|
|
MCP authentication is configured separately in **Settings > Authentication**. When enabled, external requests to `/mcp`, `/api/v2/libs/search`, and `/api/v2/context` require a personal API key. When disabled, those endpoints allow anonymous access. The local MCP bridge can still call the v2 endpoints over loopback.
|
|
|
|
The legacy global `API_KEY` environment variable protects the broader HTTP API independently of personal MCP keys. New deployments should use dashboard users and personal keys for MCP clients.
|