Use Authorization: Bearer nt_... or X-API-Key: nt_... for API & MCP. Keys shown only once.
Example: curl -H "Authorization: Bearer nt_..." https://notes.hyperbytes.in/api/notes
curl -H "X-API-Key: nt_..." https://notes.hyperbytes.in/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'