Use OAuth 2.0 wherever your MCP client supports it. That covers Claude on the web and desktop, ChatGPT, Cursor, VS Code and Gemini CLI. Use an MCP key only when a client can send nothing but a fixed Authorization header. OAuth leaves no key to copy, store or rotate, which is the whole advantage.
How each one works
With OAuth, you add the server URL to your assistant. It sends you to Safeguard's sign-in page. You sign in at app.safeguard.sh, check the app name and the host the page says the authorization code will be sent to, and click Authorize access. The client registers itself, and no secret ever sits in a config file.
With an MCP key, you open Settings, then Developer in Safeguard, create a key of the type MCP key, and the client sends it as an Authorization header with the value Bearer followed by the key. The key is shown once.
Decision guide
| Your situation | Choose |
|---|---|
| Claude, ChatGPT, Cursor, VS Code or Gemini CLI | OAuth |
| A client that supports remote MCP with OAuth | OAuth |
| A Custom GPT Action | MCP key (the only route) |
| A script or client that can set one fixed header and nothing else | MCP key |
| A shared team config checked into a repository | OAuth, never a key |
What a key means in practice
A key acts as the member who created it, across the whole workspace. It is not scoped to a single tool or project beyond what that member can already do and what the workspace has enabled. If your client stores it in a file, anyone who can read the file can act as you.
Three conditions stop a key from working, each within about a minute: you revoke it, the owner's account is closed, or API-key access to MCP is turned off for the workspace. That last point also explains why you may not see the Developer tab or the MCP key type at all. API-key access to MCP is turned on per workspace, so ask your Safeguard administrator.
What OAuth does not change
Either route gives the same authority: your assistant acts as you, limited by your role and by the tools your workspace has turned on. OAuth does not widen access. It only removes the stored secret.
It also does not bypass tool gating. A new workspace starts with six read-only tools, and an administrator enables the others one by one.
If something stops working
With OAuth, sign in again from your client. With a key, check whether it was revoked, whether its owner still has an active account, and whether the workspace still allows API-key access to MCP. Create a new key under Settings, then Developer if needed.
A note on look-alikes
You do not need SAFEGUARD_API_KEY, npx, or an npm package. Safeguard hosts the server and publishes no package for it. Instructions that tell you to set that variable or start a local bridge are out of date.
If you want to see what the platform finds before choosing any auth route, the free scan at gold.safeguard.sh/scan needs no account setup.
Quick check
Is a key more secure than OAuth?
No. It is a long lived credential that acts as its creator. OAuth avoids storing one.
How fast does revoking a key take effect?
Within about a minute, because the server checks each key at least that often.
Sources
Last reviewed: 19 October 2026.
