MCP server & API keys

Connect Claude, Cursor, VS Code, n8n AI agents or any Model Context Protocol client to your organization, with a scoped API key.

What you can do#

The form2wf MCP server gives an AI agent the same abilities you have in the dashboard, limited to one organization and one access level. Useful prompts:

• “Create a job application form with a résumé upload that posts to https://n8n.example.com/webhook/jobs, then give me the embed code.”
• “Which forms had failed submissions this week, and what did n8n return?”
• “Add a required phone field after the email field on the contact form.”
• “Build a customer list page from my list-customers webhook with Edit and Delete actions.”
• “Create a Brand theme with primary #0f766e and apply it to every form.”

Server details#

Creating an API key#

1. In the dashboard, open API Keys in the sidebar. You must be an organization admin or owner.

2. Click Create API Key, name it after where it will be used (“Claude Code — laptop”, “n8n reporting agent”), and choose an access level.

3. Copy the key. It is shown once — form2wf stores only a hash. The dialog also shows a ready-to-paste Claude Code command.

Access levels#

A key acts as the member who created it, and never exceeds that member's current role: demote them and their admin keys drop to their new level; remove them from the organization and their keys stop working. No key can create, list or revoke API keys, manage the team or touch billing.

Revoking a key#

Click the trash icon next to a key on the API Keys page. Revocation is immediate and permanent. The page shows each key's preview (f2w_1a2b…9f0e), creator and last-used time, so you can spot unused keys.

Connecting a client#

claude mcp add --transport http form2wf https://form2wf.com/mcp \
  --header "Authorization: Bearer f2w_your_key_here"

{
  "mcpServers": {
    "form2wf": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://form2wf.com/mcp", "--header", "Authorization:${F2W_AUTH}"],
      "env": { "F2W_AUTH": "Bearer f2w_your_key_here" }
    }
  }
}

{
  "mcpServers": {
    "form2wf": {
      "url": "https://form2wf.com/mcp",
      "headers": { "Authorization": "Bearer f2w_your_key_here" }
    }
  }
}

{
  "inputs": [
    { "type": "promptString", "id": "f2w-key", "description": "form2wf API key", "password": true }
  ],
  "servers": {
    "form2wf": {
      "type": "http",
      "url": "https://form2wf.com/mcp",
      "headers": { "Authorization": "Bearer ${input:f2w-key}" }
    }
  }
}

curl -s https://form2wf.com/mcp \
  -H "Authorization: Bearer f2w_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}}'

Security#

• Least privilege: reporting and support agents get viewer. Use admin only for agents that must delete forms or manage access.
• One key per agent or machine, named clearly, so you can revoke one without breaking the others.
• Keep keys out of git. Use your client's secret/prompt features or environment variables. If a key leaks, revoke it and create a new one.
• Secrets stay hidden: webhook header values are never returned through MCP — tools show [redacted], and writing the placeholder back is rejected so an agent can't wipe a real secret.
• Review destructive actions: most clients ask before running tools; approve delete_form and set_form_access deliberately.

Troubleshooting#