Skip to main content

​
Who can manage keys

Only the dealership owner or an accepted team administrator can list, create, or revoke MCP keys. Regular team members cannot manage credentials.

​
Expiration choices

Every key expires after exactly 30, 60, or 90 days. AutoFire allows at most five active keys per dealership. Use a separate, clearly named key for every client or automation so you can revoke one connection without disrupting another.

​
One-time display

The complete key is shown once. AutoFire stores a keyed one-way digest plus a short prefix for identification—not the reusable secret. If you lose a key, revoke it and create a replacement.

​
Bearer authentication

Clients must send:
Do not put the literal key in shell history or client configuration when the client supports an environment variable or secret store.

​
Rotation

  1. Create a replacement key with the same or narrower permissions.
  2. Update the client secret.
  3. Verify one tool call.
  4. Revoke the old key.

​
OAuth status

OAuth is not currently enabled for the public AutoFire MCP server. The protected-resource and authorization-server discovery endpoints remain unavailable until AutoFire completes the hosted authorization rollout. Bearer keys continue to be supported independently.