Other clients and API keys

Any MCP client that supports OAuth connects the way described in Connect Claude: add https://api.skyboxmail.de/mcp as a remote server and sign in when asked. That is the recommended way, because every such connection shows up under Settings → Connected Apps with its permissions and can be revoked there.

For a client that cannot open a browser, for example a script on a server or a local agent framework, Skybox offers API keys.

Create a key

1. In Skybox open Settings → API Keys and choose New key.
2. Give it a name and, optionally, an expiry date.
3. Pick the tools the key may call. A key with no selection may call every tool. The list is grouped like What the assistant can do; a read-only key, for instance, has just the listing and reading tools.
4. Pick the accounts the key may reach, per kind, as on the authorization screen.
5. Save. The key is shown once; copy it now. Skybox stores only a hash and cannot show it again.

API keys are a Skybox Pro feature. A key keeps working until it expires or you delete it; editing its tools or accounts applies to the next request.

Use it

The key goes into the Authorization header of every request to the MCP endpoint:

Authorization: Bearer <your key>

A client that takes a URL and headers can use that directly. A client that only speaks to local MCP servers over stdio, such as an older Claude Desktop configuration, reaches the remote server through the mcp-remote bridge. Skybox shows a ready-made configuration for this under Settings → MCP:

{
  "mcpServers": {
    "Skybox Mail": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://api.skyboxmail.de/mcp",
        "--header",
        "Authorization: Bearer YOUR_API_KEY"
      ]
    }
  }
}

Keys and connected apps compared

	Connected app (OAuth)	API key
Set up by	Signing in when the client asks	Copying a secret into the client
Permissions	The scopes the app asks for, shown before you allow	The tools you pick, one by one
Accounts	Selected on the authorization screen, editable later	Selected when creating the key, editable later
Listed under	Settings → Connected Apps	Settings → API Keys
Ends when	You revoke it, or the app is removed	You delete it, or it expires

Treat an API key like a password: anyone holding it can act as you within its whitelist. Prefer a key with a narrow tool selection and an expiry date, and delete a key you no longer use.