Build
Authentication
The live Apogee MCP and REST APIs currently use auth: none. There is no API key console, OAuth issuer, or credential revocation UI.
Clients authenticate by opening HTTPS to the public URL. Discovery documents and GET /api/mcp set auth to "none". CORS allows authorization and x-api-key so generic hosts can send headers; the server does not validate them.
Official USD plans (1 day $100, 3 days $250, 1 week $500, 1 month $2,500, lifetime $5,000) are sold by sending SOL or USDC to the published Solana treasury, then pasting the Solscan tx link. 25% is allocated to a manual $ORBITX buy-and-burn after payment. APOGEE_MCP_GATING is off, so the public MCP URL still uses auth none. Do not pay any other address or anyone selling Apogee MCP API keys — there are none.
How credentials are created
They are not. There is no create-key flow in this repository.
Lifetime, storage, revocation, scopes
Not applicable to Apogee MCP today. If you wrap Apogee behind your own OAuth, that is your system — document it separately and keep secrets in environment variables.
User vs server authorization
Read tools are public. Financial effect still requires a user to sign in their own wallet (Phantom EIP-1193). Apogee never holds keys.
NEVER
const API_KEY = "secret..."; // do not hardcode secrets even if you add your own proxy
DO
const url = process.env.APOGEE_MCP_URL ?? "https://apogeemcp.digital/api/mcp";
An optional Supabase Edge Function proxies the canonical MCP and may send the public anon key as a Supabase gateway header. That key is a public anon credential, not an Apogee API secret. NVIDIA_* keys are server-only for Orbit and are not MCP credentials.