Use API-key MCP servers as Claude connectors.

Claude's custom connectors sign in with OAuth, or not at all. They can't send an API key or a custom header, which is what lots of MCP servers want. Keyshim sits in between: Claude signs in to Keyshim, and Keyshim adds your key to every call.

Get early access How it works

How it works

  1. Deploy to your own accountA small Cloudflare Worker on the free plan, in your own Cloudflare account. You set the server's URL and the header it wants. Your key never passes through keyshim.com.
  2. Add it in ClaudePaste your bridge's address (it ends in /mcp) as a custom connector. Claude signs in to it with OAuth.
  3. ApproveOn your bridge's own page, type your passphrase and, unless you set one shared key, paste the key. It's stored encrypted and never logged. You approve again every 30 days, and whenever the server rejects a key you pasted.
  4. DoneEvery call carries your header to the server, and replies stream back, live updates included.

Get started

The source is going public soon. Once it is, setup is a few commands on your own Cloudflare account, plus a few settings in wrangler.toml: the storage id the second command prints, your server's URL, the header it wants and any text before the key, and your bridge's own address. Needs Node 22 or newer.

npm install
npx wrangler login
npx wrangler kv namespace create OAUTH_KV
# paste the namespace id and your settings into wrangler.toml
npx wrangler secret put OWNER_PASSPHRASE   # 16+ characters, long and random
npx wrangler deploy

Want it first? Email hello@keyshim.com and we'll let you know the day it's out.

Pricing

Keyshim

Free source coming soon
  • One MCP server per deployment
  • Per-connection or shared key
  • Runs on Cloudflare's free plan
Get started

Keyshim Pro coming soon

Paid price to be announced
  • Many MCP servers behind one deployment
  • A page to see and revoke connections
  • Swap a per-connection key without reconnecting Claude
  • One-command setup and email support
Tell me when it's out

FAQ

Is my key safe?
A key you paste on the approval page lives inside that connection's OAuth grant in your own Cloudflare account, encrypted so only a valid token for that connection can unwrap it. A shared key is a secret in your own Cloudflare account. Tokens are stored only as hashes. Keyshim never logs your key or tokens, and it ships with Cloudflare's Workers Logs turned off.
Who can connect to my Keyshim?
Only someone who knows your passphrase can approve a connection, and access is only ever sent back to claude.ai or claude.com. Anyone you give the passphrase to can connect. Wrong guesses are limited to a few a day per address, but still use a long random passphrase from a password manager.
Which servers work?
Remote MCP servers that use the Streamable HTTP transport and take one static header, such as an API key, at an https address that doesn't redirect. Local servers you run on your own computer, and the older HTTP+SSE transport, aren't supported. It works with custom connectors in claude.ai and the Claude apps; Claude Code and other MCP clients can't connect.
Does it work with servers that have their own OAuth?
No. Keyshim is for servers that take a static key or header. Servers with their own sign-in can connect to Claude directly.
Is this made by Anthropic?
No. Keyshim is an independent tool from Vein that works with Claude's custom connectors.