Documentation menu
Authentication
Every request to the NFL MCP server is authenticated. You can connect with OAuth 2.1 (recommended for supported clients) or a static API key. Both identify the same account, and usage is metered against that account either way.
Last updated 2026-07-16
OAuth 2.1 (recommended)
OAuth 2.1 is the recommended path for clients that support remote MCP servers, such as Claude Desktop. You add the canonical endpoint and sign in through your browser — no API key is created, copied, or stored in the client configuration. The server advertises its authorization server at /.well-known/oauth-protected-resource, and a compliant client discovers and completes the flow for you.
https://mcp.nflmcp.com/mcpFollow the dashboard quickstart for exact, copy-paste configuration for each supported client.
API key
Use a static API key for scripts, backend jobs, or clients that do not support remote OAuth. Create a key in the dashboard — the raw value is shown once at creation, so store it somewhere safe. Send it as a bearer token on every request:
Authorization: Bearer YOUR_API_KEYKeys are account-scoped. Daily usage is counted per account across every key you own, so rotating or adding keys does not reset your usage. See Rate limits & quotas.
Which should I use?
| Use | When |
|---|---|
| OAuth 2.1 | Interactive MCP clients that support remote sign-in (Claude Desktop, and other OAuth-capable clients). No secret to manage. |
| API key | Scripts, servers, CI, or clients without remote OAuth. You manage the secret and send it as a bearer token. |
Verify your connection
To confirm a key and endpoint work, list the tools your account can access. A valid request returns the tool catalog; an invalid or revoked key returns HTTP 401 with { "error": { "code": "invalid_key" } }.
curl -X POST https://mcp.nflmcp.com/mcp \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'