API Keys
API keys authenticate your MCP server with ShowHub. Each key is tied to your account and grants access to all podcasts you own.
Creating a key
Each key has a label (e.g. “Cursor”, “Claude Desktop”, “CI Pipeline”) and can optionally expire after a set number of days. You can have up to 5 active keys at a time; revoke one before creating another.
Keys use the format shub_ followed by 64 hexadecimal characters:
shub_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdefHow keys are stored
ShowHub never stores your raw key. When you create a key, the server:
- Generates a cryptographically random key.
- Hashes it with SHA-256.
- Stores only the hash and a short prefix for identification.
This means ShowHub staff cannot see your keys, and a database breach would not expose them.
Managing keys
Viewing active keys
Each key record includes:
| Field | Description |
|---|---|
| Label | The name you gave the key. |
| Prefix | The first 12 characters (e.g. shub_a1b2c3d), useful for identification. |
| Created | When the key was generated. |
| Last used | The most recent API call using this key (updated at most once a minute). |
Revoking a key
Revoking a key disables it immediately. Revoked keys cannot be un-revoked. Create a new one instead.
When to revoke:
- You suspect the key was exposed.
- You no longer need the integration.
- You’re rotating keys as a security practice.
Security best practices
- One key per client. Create separate keys for Cursor, Claude Desktop, CI, etc. If one is compromised, you only revoke that one.
- Never commit keys. Use environment variables, not hardcoded strings.
- Rotate periodically. Create a new key, update your client config, then revoke the old one.
- Revoke unused keys. If you stop using a client, revoke its key.
Permissions
API keys grant access to everything you can do through the MCP:
- Read account and podcast info
- Create and configure podcasts
- Connect and disconnect sources
- Update branding and embed settings
- Manage episodes
Keys are scoped to your user account. You cannot access podcasts owned by other users, even with a valid key.
Troubleshooting
| Error | Cause | Fix |
|---|---|---|
Missing or invalid Authorization header. Use 'Bearer shub_...' | No key was sent | Check your MCP client config sets SHOWHUB_API_KEY |
Invalid API key format | The value doesn’t start with shub_ | Copy the full key again |
Invalid, revoked, or expired API key | Key is wrong, expired, or revoked | Check the key or get a new one |
Podcast not found or unauthorized. | Key is valid but you don’t own the podcast | Verify the podcast ID belongs to your account |
In MCP clients, any 401 response appears as Authentication failed. Check your SHOWHUB_API_KEY.
Next
- Quickstart: set up your MCP client
- Tool Reference: see what the API key unlocks