AccountAPI Key Management

API key management

Create and manage API keys to connect Claude Desktop, ChatGPT, and other AI agents to your Nomadfiling account through the MCP server.

Create and manage API keys for MCP access

API keys let you connect Nomadfiling to Claude Desktop and other MCP clients without sharing your account password. You create keys from the API Keys page, copy the plaintext value once, then use that key as a Bearer token when a client connects to the MCP server.

The API Keys page lives at /api-keys and requires sign-in. If your session has expired, Nomadfiling redirects you to /login.

Before you start

You need:

  • A Nomadfiling account with access to the dashboard
  • An active session in the web app
  • The MCP server URL for your environment
  • A client that supports either API key authentication or OAuth, depending on the integration path

The MCP endpoint is:

{API_BASE_URL}/mcp-server

If you are configuring a local client file, keep the endpoint and key together so you can test the connection immediately after creating the key.

Create an API key

Create the key in the dashboard first, then copy it into your MCP client configuration.

Open the API Keys page

Sign in to Nomadfiling, then open /api-keys. If you are not signed in, the app sends you to /login before showing the page.

You should see a form to create a new key and a list of existing keys below it.

Enter a name for the key

Add a descriptive name such as Claude Desktop on MacBook Pro or Internal agent staging. Nomadfiling requires a name and shows a warning if you leave the field blank.

A good name makes it easier to revoke the correct key later without interrupting other clients.

Generate the key

Click the button to generate the key. Nomadfiling creates 32 cryptographically random bytes, formats them as a hex token with the nf_ prefix, and produces a 67-character key.

The app hashes the token with SHA-256 before storing it and saves only the hash, the key name, and a short prefix for identification.

Copy the plaintext key immediately

After generation, Nomadfiling shows the full plaintext token once in a banner with a copy button. The banner states that the key will not be shown again.

Copy the key into your password manager, secret store, or MCP client configuration before you dismiss the banner.

Dismiss the banner after saving the key

Click Got it after you have saved the key. Nomadfiling clears the plaintext value at that point, and you cannot recover it later.

If you lose the key, create a new one and update any clients that used the old value.

Nomadfiling shows the plaintext API key only once. After you dismiss the banner, the stored record contains only a SHA-256 hash and a short prefix such as nf_a3f2b1c4d….

What Nomadfiling stores for each key

Nomadfiling stores enough metadata to identify and manage the key without retaining the secret itself.

namestring
Required

The label you assign to the key in the dashboard. Use a name that maps to a device, environment, or client.

key_prefixstring
Required

A short display prefix derived from the token, formatted from the first characters of the key and an ellipsis. Nomadfiling uses this prefix in the key list so you can identify which key to revoke.

key_hashstring
Required

A SHA-256 hash of the plaintext token. Nomadfiling stores the hash instead of the secret.

user_idstring
Required

The account that owns the key.

created_atstring
Required

The creation timestamp shown in the key list.

last_used_atstring

The last time the key was used. Use this field to find stale keys before revoking them.

Review and revoke keys

The API Keys page lists every key for your account with:

  • Name
  • Key prefix
  • Creation date
  • Last-used date

Each row also includes a red trash icon for deletion. When you delete a key, Nomadfiling asks for confirmation with the message Delete this API key? Any MCP client using it will stop working.

Revoke unused keys regularly. The last-used date is the fastest way to spot old local configs, retired laptops, or test agents that no longer need access.

Configure Claude Desktop with an API key

Claude Desktop connects to Nomadfiling's MCP server by sending your API key in the Authorization header as a Bearer token.

{
  "mcpServers": {
    "nomadfiling": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "{API_BASE_URL}/mcp-server"
      ],
      "env": {
        "MCP_REMOTE_HEADERS": "{"Authorization":"Bearer nf_example_9xmk7q2r4b7m8n2p6t1v5c8a"}"
      }
    }
  }
}

After you save the configuration, restart Claude Desktop. A successful connection makes the Nomadfiling tools available in the client.

Configure ChatGPT with OAuth

ChatGPT uses OAuth rather than a manually pasted API key. Add Nomadfiling as a custom connector from the ChatGPT settings UI, then let ChatGPT discover the OAuth metadata automatically.

Open connectors in ChatGPT

In ChatGPT, go to Settings, then Connectors, then Add custom connector.

Enter the MCP server URL

Use the Nomadfiling MCP base URL as the connector target. ChatGPT reads OAuth metadata from the well-known discovery endpoints exposed by the server.

Complete OAuth authorization

Finish the sign-in and consent flow in the browser window ChatGPT opens. The server supports OAuth discovery for authorization and protected resource metadata.

After the flow completes, ChatGPT can call Nomadfiling tools without a manually created API key.

The OAuth discovery endpoints are:

/.well-known/oauth-authorization-server
/.well-known/oauth-protected-resource

Configure a custom OAuth client

If you are building your own MCP-compatible client, use the server's OAuth endpoints directly.

authorization endpointURL
Required

The endpoint your client sends users to for the authorization code flow.

token endpointURL
Required

The endpoint your client exchanges the authorization code with to obtain access and refresh tokens.

registration endpointURL
Required

The endpoint for dynamic client registration when your client supports it.

scopestring
Required

Use the mcp scope.

code challenge methodstring
Required

Use S256. PKCE is required.

grant typesstring
Required

Use authorization_code and refresh_token.

Available MCP tools

Once your client is connected, it can call the following tools exposed by the Nomadfiling MCP server.

  • list_filings
  • create_filing
  • get_filing
  • update_filing
  • delete_filing
  • list_partnership_filings
  • get_partnership_filing
  • create_partnership_filing
  • update_partnership_filing
  • delete_partnership_filing
  • list_payments
  • list_fax_logs
  • get_form_schema
  • get_pdf_url

Use the MCP tool reference for tool inputs, outputs, and behavior details.

Security practices

A few habits prevent most key-related outages and leaks.

Frequently asked questions

MCP overview

Authentication

MCP tools

Profile settings

If you want to test the connection after setup, return to the dashboard and create or review a filing before calling Nomadfiling from your MCP client.

Was this page helpful?