OAuth
If your client supports OAuth for MCP, give it the server URL only. It discovers everything else from the server’s metadata. See Authentication.API key
If your client lets you set custom headers, use a workspace API key:type, url, headers, serverUrl) differ between clients. Check your client’s documentation for its spelling.
Test the connection with curl
An unauthenticated request returns401 and a WWW-Authenticate header that points to the OAuth metadata:
-H "X-API-Key: wbk_your_api_key".