Security, OAuth and MCP

Key rulesCopy Anchor Link

• Keep keys on your server. A key in a browser, an app or a public repo is a leaked key.
• Use a test key until you ship. Use one key per service, with only the scopes it needs.
• Revoke a key at krexa.xyz/developers. The revoke works at once.
• Keys have a checksum, so secret scanners can find a leaked kxp_ key.
• Krexa-End-User must be a stable id that you own. Never let the end user choose it.

Connect a Krexa user (OAuth)Copy Anchor Link

Use this only when a person already has a Krexa account and wants to link it. It is OAuth 2.1 with PKCE (S256).

• Metadata: https://api.krexa.xyz/.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource.
• Send the user to GET /api/v1/oauth/authorize with client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256 and resource.
• They approve on krexa.xyz. You get a code that is good for 60 seconds.
• POST /api/v1/oauth/token with your X-API-Key (grants authorization_code or refresh_token).
• Send the user token as Authorization: Bearer kxu_… next to your X-API-Key. It lasts 1 hour. The refresh token lasts 30 days and changes on each use.
• The user can disconnect your app at any time.

MCP for agentsCopy Anchor Link

Your AI agent can use Krexa tools over MCP at https://api.krexa.xyz/api/v1/mcp. Send the same two headers:

{
  "mcpServers": {
    "krexa": {
      "url": "https://api.krexa.xyz/api/v1/mcp",
      "headers": { "X-API-Key": "kxp_…", "Krexa-End-User": "user_123" }
    }
  }
}

A partner key gets research and paper tools only. Tools that need a wallet or move money are not offered.

MoneyCopy Anchor Link

• A partner key can never take custody of funds or withdraw.
• Live deploys need a Krexa review of your org, a live key with live:propose, and the end user's approval on krexa.xyz for each deploy.