Access and API Keys
Sports MCP Server has two distinct access layers: caller access to the MCP server itself, and server-side access to upstream providers.Split the access model correctly
- What the caller needs
- What the server owns
- What entitlements change
The caller needs one bearer API key scoped to the
sports-mcp-server product.That key is used to:- authenticate the request
- apply product-scoped policy
- enforce rate limits and quotas
- attribute usage to the correct customer context
Source families behind the contract
Integration rules
- Keep caller auth separate from upstream provider auth.
- Avoid exposing the bearer key directly to public browser clients.
- Expect partials when one upstream source is unavailable or not entitled.
- Keep provenance visible when rendering hybrid answers.