Every request to the MCP server must be authenticated with a Salesgraph API key. A key
identifies your organization — all tool calls run scoped to that org’s data and connected
integrations.
API keys
Keys are created and revoked from Settings → API Keys.
- Keys are prefixed with
sg_live_.
- The full key is shown only once, at creation. Store it securely.
- Only a short prefix (e.g.
sg_live_ab12…) is ever displayed afterward, so you can tell keys apart.
- Keys don’t expire, but you can revoke any key at any time. Revocation takes effect immediately.
Use a separate key per integration or environment (e.g. one for production, one for local
testing). That way you can revoke a single key without disrupting everything else.
Sending the key
Send your key on every request using either header:
Most MCP clients have a dedicated field for the URL and a place to add a custom header — use
the Authorization: Bearer <key> form there.
Unauthorized responses
A missing, malformed, or revoked key returns:
with HTTP status 401 and a WWW-Authenticate: Bearer header.
Scope and isolation
- A key only ever accesses the organization it was created for.
- Async runs (GTM audits, org audits) are also scoped to
the org: polling a run id that belongs to another org returns
not found.
- Which tools return enriched results depends on the integrations connected to your org. Check
with
list_capabilities.
