---
title: "Unified MCP Server"
url: "https://docs.unified.to/mcp/authentication"
description: "Unified.to documentation"
generated_at: "2026-06-12T19:00:06.128Z"
---
# Unified MCP Server

## [Authentication](#authentication)

There are two authentication options;

### [1\. Private LLM API Authentication for 1 Connection:](#%5F1-private-llm-api-authentication-for-1-connection)

Use this option when your application connects directly to the Unified MCP Server or it gives the LLM API the Unified MCP Server remote URL.

This token is NOT safe to give out publically as it is a Unified.to workspace API key and will grant access to all of your connections and Unified.to account.

|            |                                                                                           |
| ---------- | ----------------------------------------------------------------------------------------- |
| connection | An end-customer’s connection ID from Unified                                              |
| token      | Exactly the same as a Unified.to [workspace API key](https://app.unified.to/settings/api) |
|            |                                                                                           |

### [2\. Private Workspace-only Authentication:](#%5F2-private-workspace-only-authentication)

Use this option to engage with data in your workspace such as connections, webhooks, API calls, and issues/tickets. This data is configuration data and not your end-customer's data from connections.

|       |                                                                                           |
| ----- | ----------------------------------------------------------------------------------------- |
| token | Exactly the same as a Unified.to [workspace API key](https://app.unified.to/settings/api) |
|       |                                                                                           |

### [Notes](#notes)

You can provide the `token` either as a `token` URL parameter (eg. `?token={token}`) or in the Authorization header as a `bearer token` (eg. `Authorization: bearer {token}`)

All other parameters must be sent as URL parameters.