MCP security and troubleshooting

API keys are shown once. Store them in the MCP client's secret configuration, choose read-only unless writes are required, scope them to sites, review last-used dates, and revoke unused keys.

A 401 usually means the key/header is missing, invalid, or revoked. A read-only rejection means the requested tool mutates data. A site-scope error means the key cannot access that site. Expired or suspended plans can pause tools. Confirm the endpoint is exactly https://pageduel.com/api/mcp, then create a fresh narrowly scoped key if the secret is uncertain.