Authentication
KPainter MCP uses the same user API key as KPainter OpenAPI.
Recommended: Environment Variable
For a local stdio client, place the key in the MCP server environment:
{ "env": { "KGP_API_KEY": "<your_api_key>" }}Tools also accept an explicit api_key argument. A multi-user service must pass each user's own key instead of sharing one key across users.
Verify After Connecting
Call kp_capabilities. A successful account-scoped response confirms authentication. If it fails, ask the user to review or reactivate the key on the API Key page.
Security
- Never show the complete key in a conversation, log, screenshot, or error.
- Do not send it to an unrelated service.
- Do not use a server default key in an uncontrolled multi-user environment.
- Update the MCP client configuration after a key reset.
- MCP does not activate, reset, or delete API keys.
Common Problems
- Missing key: configure KGP_API_KEY or pass api_key from a trusted caller.
- Invalid key: verify the account and key state.
- Insufficient permission: stop before creating and explain that the account cannot use the capability.
- Insufficient balance: keep the paused creation and continue it after the user resolves the balance.