Server details
How authentication works
Connect with your Baselayer login through OAuth, or use an existing customer API key if your MCP client supports custom HTTP headers or bearer tokens. Both methods use the same server URL and expose the same tools.OAuth: sign in with Baselayer
When you add the server to an OAuth-capable client, the client discovers Baselayer’s login page automatically. Sign in with your Baselayer credentials and approve the consent screen: “Search and verify businesses with Baselayer on your behalf”. The client receives an OAuth token; no API key is required. Every OAuth tool call runs as you, scoped by the same organization membership and role permissions that govern your access in the Baselayer Console. If you do not have a Baselayer account yet, the login page links to self-serve sign-up.API key: connect with custom headers
Use an existing Baselayer customer API key with the same access you use for the REST API. No separate MCP key, grant, role, or opt-in is needed. Configure your client’s remote MCP connection with:- Server URL:
https://api.baselayer.com/mcp - Transport: Streamable HTTP
- Custom header:
X-API-Key: <your-baselayer-api-key>
Authorization: Bearer <your-baselayer-api-key>.
If your client provides a bearer token field, enter the raw API key without the
Bearer prefix. Send your chosen header on every request, without OAuth.
Requests containing both X-API-Key and any Authorization header are
rejected, as are duplicate credential headers.
Tool calls use the key’s permissions, grants, and organization/application scope, just as they do on the REST API. Organization keys with explicit grants must include api; exports-only and operator keys cannot use MCP. Keys without explicit organization grants retain their existing API access.
An invalid or revoked key returns a 401 error; an exports-only or operator key returns 403. Key authentication errors do not trigger an OAuth login challenge. Revocation and permission changes take effect on the next request or tool call; work already running is not cancelled.
Claude Managed Agents
Use an organization key for the intended sandbox or production application. Register it in an Anthropic vault with this credentialauth object:
token field contains the raw key, without the Bearer prefix. Declare
the server and its matching toolset on the agent:
vault_ids when creating the session. The vault
credential’s mcp_server_url must match the agent’s server URL. If the
session’s environment restricts network access, allow api.baselayer.com.
Anthropic supplies the bearer header automatically; no OAuth flow is needed.
See Anthropic’s vault documentation and MCP connector setup.
Organizations and applications
With OAuth
By default, tool calls run in your default organization and its production application. This is the right choice for most users. If you belong to several organizations, or want to work against a sandbox application, use a client that supports custom request headers:
See Claude for connection instructions.
With an API key
Organization keys are bound to their organization and application, including its sandbox or production environment. Request headers cannot switch an organization key to a different organization or application. To change the environment, use a key for the intended application. Federation keys retain their federation grants. To target an application, sendX-External-ID with the target application’s external ID, or send both X-Organization-ID and X-Application-ID. The target must belong to the key’s federation, and the key must allow the target’s sandbox or production environment.
See Sandbox vs. production environments for how the two environments differ.
Billing
Tools that start a search or verification order the same paid work as the matching REST endpoint, at the same price, and appear in your usage the same way. Read tools (get_*) are free. search_watchlists writes one billable order per watchlist requested, so ask for only the watchlists you need. search_international_business bills each add-on in options separately, and analyze_online_presence adds an international surcharge for a business outside the US. Both charges apply when the request is submitted, whether or not it finds a match.