The Instantly MCP server supports multiple authentication methods. Choose the one that fits your MCP client.
Send your API key in the Authorization header. This is the recommended method — it keeps your key out of server access logs and client history.
The bearer token prefix is also accepted:
Use the x-instantly-api-key header if your client does not support the Authorization header.
URL-based authentication
Use this only if your MCP client cannot set custom headers. The key is part of the request URL, so it may be recorded in intermediary and server logs.
Keep your API key secure. Never expose it in client-side code, share configuration files that contain it, or commit it to source control.
