# DotMock auth.md

> Authentication guidance for agents and MCP clients connecting to DotMock.

## Audience
This document is for coding agents, MCP clients, CI jobs, and developers operating inside an existing DotMock workspace.

## Supported method
- Method: Team-scoped API key
- Provisioning: A signed-in workspace member creates the key in https://dotmock.com/settings/team/api-keys
- Transport: Send the key in the `x-api-key` header
- MCP endpoint: https://mcp.dotmock.com/mcp
- Unattended public registration: Not supported
- OAuth authorization server: Not available

## MCP client configuration
```json
{
  "mcpServers": {
    "dotmock": {
      "type": "http",
      "url": "https://mcp.dotmock.com/mcp",
      "headers": {
        "x-api-key": "${input:dotmock-api-key}"
      }
    }
  }
}
```

## Credential boundaries
- The team API key is a management credential. Keep it in the MCP client's secure input or secret store.
- Never place a management credential in an OpenAPI example, mock response, fixture, captured payload, or request to `$MOCK_URL`.
- Runtime authentication configured for a mock is separate from management authentication.
- Tool visibility and execution are restricted by the key's team, scopes, permissions, plan, and allowed-tool policy.

## Safe execution
- Inspect the workspace before authoring.
- Prefer validation, simulation, and dry-run tools before live or persistent actions.
- Publication, rollback, deletion, state reset or restore, traffic promotion, and live protocol tests require explicit approval in their tool schemas.

Documentation: https://dotmock.com/docs/features/mcp-integration