Validating Credentials
Validation checks that a saved connection can call the provider’s API. MCPBundles runs validation when a provider supports it on save; you can always retry with Validate Now and a chosen test tool.
When validation runs
| Trigger | What happens |
|---|---|
| Save connection | Many providers auto-run a default read-only test or mark OAuth tokens VERIFIED after exchange |
| Validate Now | You pick (or keep) a validation tool and run an explicit test from the connection panel |
| Re-validate | Same as Validate Now after key rotation, scope changes, or errors |
Validation uses live API calls, not mocks.
Where to connect and validate
- MCP server → Connections → Connect on a provider row
- Settings → Credentials → provider → add or edit a connection
The connection panel slides in from the right. OAuth returns you to the same panel when the popup closes.
Typical flow
- Connect and enter an API key or complete OAuth (Connect with [Provider]).
- Click Create Connection (or Update Connection when editing).
- If the provider supports auto-validation, status may move to VERIFIED immediately.
- Otherwise choose a validation tool (recommended tools are marked) and click Validate Now.
- Fix any ERROR message and retry.
Verified connections on the MCP server you are using drive the header status (Ready, Needs setup, Needs attention). For composed private servers, validate connections on that server’s Connections section — not only on a catalog copy of the same provider. See Composing MCP servers.
Connection statuses
| Status | Meaning | What to do |
|---|---|---|
| VERIFIED | Last validation succeeded | Use tools; re-validate after key rotation if needed |
| UNVERIFIED | Saved but not validated yet | Run Validate Now |
| ERROR | Validation failed | Read the message; fix key, URL, or scopes; retry |
| EXPIRED | OAuth or token past lifetime | Reconnect |
| PENDING | Save or OAuth still in progress | Wait, then validate |
API key connections
- Copy the key from the provider’s dashboard (no extra spaces).
- Paste into the connection panel; fill any required fields (instance URL, region, etc.).
- Optional connection name for multiple accounts (e.g. “Production”).
- Create Connection → auto-validate or Validate Now.
OAuth connections
- Optional connection name.
- Connect with [Provider] → approve scopes in the provider window.
- Return to the panel; token is stored encrypted.
- Run Validate Now if status is not already VERIFIED.
OAuth tokens refresh on use for most providers; you do not need a separate hourly refresh job.
Picking a validation tool
Good validation tools are usually:
- Read-only (list, get, whoami)
- Fast, with few or no required parameters
- Shown with a Recommended badge when the catalog defines one
Use Change tool (or the tool picker) if the default test fails but you suspect the credential is fine — e.g. try a simpler read endpoint.
Common errors
| Message | Likely cause |
|---|---|
| Invalid API key | Typo, revoked key, wrong environment |
| Authentication failed | Expired OAuth; reconnect |
| Insufficient permissions | Missing OAuth scopes; reconnect and approve all requested scopes |
| Connection failed | Provider outage or network; retry later |
For MCP server-level symptoms (tools missing in AI, header stuck on Needs setup), see Troubleshooting connectivity.
Webhook ingest connections
Some providers use a webhook ingest panel (ingest URL, optional HMAC signing, last delivery time). That is separate from A2A webhook triggers. See Webhook data capture.
CSV upload connections
Some servers use a CSV upload panel (drop the file on the source in the side panel, no ingest URL). Validation confirms the source. Each source keeps one file, and a later upload replaces it. See CSV upload for MCP servers.
After validation
- MCP server header can show Ready when all required providers on that server are verified.
- Test tools in MCPBundles Studio.
- Add the MCP URL to your AI client (Connecting your AI).
Related
Support: help@mcpbundles.com