PRACTICAL FIELD GUIDE
Use a create-only key for a server-side integration
A server job that only inserts records does not need broad read, update or delete privileges. Scope the machine key to the required table and operation.
MCPBackend editorial team · · Examples are illustrative
Put it into practice
- List the exact table and actions the integration requires.
- Create a scoped key and store it in the server's secret configuration.
- Test an allowed insert and denied read, update and delete requests against disposable data.
What this looks like
ILLUSTRATIVE EXAMPLE
A lead-ingestion service can create leads but cannot export the entire contact list using its key.
A boundary to keep clear
A restricted key is still a secret. Limited privileges do not make browser exposure or log output appropriate.
MCPBackend context
MCPBackend row policies apply to anonymous callers and end-user tokens. Machine API keys bypass those row policies and are instead constrained by their own table permissions. Owner mode is based on the calling user's identity; it is not an organization-membership or arbitrary custom-policy engine.
Take the next step
Inspect the current project contract, try the change with disposable data, and verify the result through the same credentials your app will use. Record the expected response and one denied-access case before release.
Sources and further reading
These references explain the underlying protocols and design principles. For supported MCPBackend operations and exact request shapes, inspect your project’s generated API contract.