API key validation middleware for MCP servers built with MCP Fusion. Timing-safe comparison, SHA-256 hashing, async validators, and self-healing error responses.

Quick Start

import { initFusion } from '@vinkius-core/mcp-fusion';
import { apiKeyGuard } from '@vinkius-core/mcp-fusion-api-key';

const f = initFusion<AppContext>();

const withApiKey = apiKeyGuard({
    keys: [process.env.API_KEY!],
    header: 'x-api-key',
});

export default f.query('data.export')
    .use(withApiKey)
    .handle(async (input, ctx) => {
        return db.records.findMany();
    });

Features

| Feature | Description | |---------|-------------| | Timing-Safe | Constant-time key comparison prevents timing attacks | | SHA-256 Hashing | Store hashed keys instead of plaintext | | Async Validators | Validate keys against a database or external service | | Self-Healing | Missing/invalid keys return actionable hints to the LLM agent | | Key Rotation | Support multiple keys for seamless rotation |

SHA-256 Hashed Keys

const withApiKey = apiKeyGuard({
    hashedKeys: ['a1b2c3...'], // SHA-256 hash of the actual key
    algorithm: 'sha256',
});

Async Validator

const withApiKey = apiKeyGuard({
    validate: async (key) => {
        const record = await db.apiKeys.findUnique({ where: { key } });
        return record !== null && record.revokedAt === null;
    },
});

Installation

npm install @vinkius-core/mcp-fusion-api-key

Peer Dependencies

| Package | Version | |---------|---------| | @vinkius-core/mcp-fusion | ^2.0.0 |

Requirements

• Node.js ≥ 18.0.0
• MCP Fusion ≥ 2.0.0 (peer dependency)

License

Apache-2.0