atom-marketplace-mcp-server/MCP_API_KEY_SETUP.md

MCP server for Atom marketplace APIs - domain search, availability, trademarks, and appraisals

# MCP API Key Setup

## Overview
The MCP server now requires an additional API key for extra security protection. This is separate from the existing API token and user ID that are used for backend authentication.

## Environment Variables

Add the following environment variable to your Vercel deployment:

```
MCP_API_KEY=your-secure-api-key-here
```

## Usage

### For ChatGPT Custom GPTs
When calling the MCP server, include the API key in the request headers:

```
X-MCP-API-Key: your-secure-api-key-here
```

### For Direct HTTP Requests
Include the header in your curl requests:

```bash
curl -X POST "https://mcp.atom.com/api/chatgpt-mcp" \
  -H "Content-Type: application/json" \
  -H "X-MCP-API-Key: your-secure-api-key-here" \
  -d '{
    "method": "semantic_search_domains",
    "params": {
      "query": "your query here"
    }
  }'
```

## Security Notes

1. **Keep the API key secure** - Don't commit it to version control
2. **Use a strong, random key** - Generate a secure random string
3. **Rotate regularly** - Change the key periodically for security
4. **Optional but recommended** - If not set, API key validation is skipped (for backward compatibility)

## Error Responses

If the API key is missing or invalid, you'll receive:

```json
{
  "jsonrpc": "2.0",
  "id": "request-id",
  "error": {
    "code": -32600,
    "message": "Missing MCP API key. Please provide X-MCP-API-Key header."
  }
}
```

or

```json
{
  "jsonrpc": "2.0",
  "id": "request-id", 
  "error": {
    "code": -32600,
    "message": "Invalid MCP API key."
  }
}
```