🔧 Install and authenticate

New here? One API key (API key, short for application programming interface — “application programming interface,” the door through which two programs communicate) is a unique code, usually a long string of letters and numbers, that the service uses to identify who’s making the request and charge for (or limit) usage appropriately. Think of it as a visitor badge: without one, the front desk (the service’s server) won’t let you in. You get this key by creating an account on the service’s website—for example, on Firecrawl, there’s a “Get API key” button in the dashboard after a quick signup, usually with a free plan that’s enough to try it out.

Each server MCP (the “connector” that gives your agent hands, explained in earlier modules) talks to a different service out there, and each service has its own key. Firecrawl (which scrapes web pages) has a key; if you later connect an email or spreadsheet MCP server, each one will ask for its own. These keys don’t get mixed up—each one opens only its own service’s door.

New here? A file .env is a plain text file inside your project folder that stores secrets — keys, passwords — outside the code and outside the conversation. It should never be shared or uploaded to the GitHub (the site where your project’s code is stored and versioned—the Trail 0 already covered how to organize your folder; the .env goes alongside it, but gets special treatment).

The filename starts with a dot on purpose: on Unix-like systems (Mac and Linux), files with a dot at the front are “hidden” by default — they don’t appear in a regular list of files, which lowers the chance you’ll accidentally drag one somewhere public. Even so, the real protection isn’t the name; it’s the .gitignore — a second text file that tells git "never track these files."

Objective: keep the key out of the chat and version control. How to verify: open the file .gitignore from the project and confirm that the line .env it’s there — so git will never try to upload this file.

Caption: the key is created on the service’s website, goes only in the .env file, and that’s where the agent reads it when needed — .gitignore and the habit of never typing the key in chat close the two most common leak paths.

Never paste an API key directly into a conversation with Claude Code. The conversation may be saved in logs, reviewed later, or even exposed in a screenshot shared by mistake. The file .env exists specifically to isolate that secret — the agent reads it from there when needed, so you don't have to type it again in every session.

This rule applies even when it seems faster to "just paste it here to test." The time saved is a few seconds; the risk is that the key gets recorded somewhere you no longer control. If you ever need to show your conversation history to someone — technical support, a coworker, a screenshot of an error — you want to be absolutely sure there are no secrets in it.

Caption: the four standard steps for securely connecting any MCP server — the key never passes through the conversation, only through the .env file.

With the key already in .env, starting the server is usually a single command in Claude Code—the agent can run it for you if you ask it to “install and configure the Firecrawl MCP server.” It reads the key from .env automatically, so you don’t have to copy and paste it again.

Objective: get the MCP server ready to use. How to verify: run /mcp in Claude Code and check whether "firecrawl" appears in the list with a connected status.

If the installation command returns an error, the most common causes are a missing system dependency (the agent usually tells you what’s missing and how to install it) or a variable name in .env that doesn’t match what the server expects—check that you wrote it exactly FIRECRAWL_API_KEY, with no space before or after the equals sign.

Before trusting the server with a big task, test it with a small, easy-to-check request—for example, ask for the title of a page you know. If the result matches what you expect, the server is working properly.

Objective: confirm that authentication and the connection work end to end. How to verify: the agent should return the page's actual title, without an authentication error or timeout.

Not every test error is about the key. Some come from the service; others come from the site you’re trying to access. Knowing which is which saves time — and keeps you from changing the .env when the problem is somewhere else.

If you suspect a key has leaked (for example, it accidentally appeared in a screenshot or public repository), replace it immediately: generate a new one in the service dashboard, revoke (cancel) the old one, and update only the file .env — nothing else in the project changes.

New here? Revoke means revoking the validity of that specific key — the service starts rejecting any request made with it, even if the person who copied it still has it saved somewhere. This is different from “deleting your account”: you still have normal access to the service, just with a new key.

Caption: step 3 (revoke) is the only one that actually shuts off access to the leaked key — generating a new key without revoking the old one leaves both valid at the same time.