---
title: "Outbound Auth with API Key"
---

API Key is the simplest outbound auth method, ideal for fixed credentials and service-to-service calls. Credentials are encrypted and hosted by Agent Identity, never appearing in your code. This page covers only what is specific to API Key; the shared `VeIdentityFunctionTool` / `VeIdentityMcpToolset` usage, the `into` default, and the common FAQ live in the [security overview](/en/docs/framework/security#outbound-authentication).

## Create an API Key credential

1. Sign in to the Volcengine console and open the **Agent Identity** service.
2. Go to **Identity Auth > Outbound Credential Hosting**.
3. Click **New > New API Key** and enter a name.
4. Enter the API Key issued by the third-party service.
5. Choose how it is passed (Header or Query) and click **OK**.

## Use it in code

Create an auth config with `api_key_auth(provider_name=...)` and pass it to `VeIdentityFunctionTool` or `VeIdentityMcpToolset`. The API Key credential injects into the function's `api_key` parameter by default (the `into` default), so you never pass it yourself:

```python
import asyncio
from veadk import Agent, Runner
from veadk.integrations.ve_identity import VeIdentityFunctionTool, api_key_auth
import aiohttp

async def query_api(api_key: str, user_id: str):
    headers = {"Authorization": f"Bearer {api_key}"}
    url = f"https://api.example.com/users/{user_id}"
    async with aiohttp.ClientSession() as session:
        async with session.get(url, headers=headers) as resp:
            return await resp.json()

tool = VeIdentityFunctionTool(
    func=query_api,
    auth_config=api_key_auth(provider_name="user-api"),
)

agent = Agent(tools=[tool])
runner = Runner(agent=agent)
asyncio.run(runner.run(messages="Look up user 123"))
```

To wrap an entire MCP service, use `VeIdentityMcpToolset` with the same `api_key_auth` config:

```python
from veadk.integrations.ve_identity import VeIdentityMcpToolset, api_key_auth
from mcp import StdioServerParameters

toolset = VeIdentityMcpToolset(
    auth_config=api_key_auth(provider_name="my-api-provider"),
    connection_params=StdioServerParameters(
        command="python",
        args=["-m", "my_api_mcp_server"],
    ),
)
```

## When to choose API Key

API Key is the simplest option with a fixed credential, ideal when no token refresh is needed. For short-lived, auto-refreshed tokens, use [OAuth2 M2M](/en/docs/framework/oauth2-m2m); to act on behalf of a specific user, use [OAuth2 user federation](/en/docs/framework/oauth2-user-federation).
