# Connect Context7

An account of Context7 is connected once, on the instance, by a person who then gives missions access to its resources; the agent never receives the credential. Look up current library documentation with Context7, through the official Context7 MCP server.

One account is a Context7 API key of a teamspace. It has one resource, the library index the key can query: the public libraries its teamspace policies allow and its private sources. The documentation questions an agent asks are sent to Context7. There is no environment.

Permissions, presets and tools of this service: [Context7 plugin](/plugins/context7).

## How to connect

On the instance: Accounts → Connect an account, then pick the service. A company app, when the service needs one, is registered once by an administrator under Settings → Administration → Company apps, or set in the configuration (`providers.<id>.*`, see [configuration keys](/docs/configuration/keys)). Every instance registers its own app: this gateway never uses an app shared with another one.

### The usual way: with a API key pasted by hand

1. Sign in to Context7 and open the dashboard.
2. In the API Keys card, choose Create API Key. Context7 shows the key once.
3. A Context7 key carries no permission choice: it reaches what its teamspace's policies allow, and Vaubaan decides which agent may ask what.
4. Copy the key and paste it here.

Where: [https://context7.com/dashboard](https://context7.com/dashboard)

What the connect page asks:

- API key (secret): Create a key in the Context7 dashboard, API Keys. A key reaches what its teamspace's policies allow; the key itself has no permission choice. The questions agents ask are counted on the plan of the person who created it.

The service's documentation: [https://context7.com/docs/howto/api-keys](https://context7.com/docs/howto/api-keys)

## Disconnecting

Revoke the key in the Context7 dashboard, API Keys. Revocation is immediate and permanent.

## Registration notes from the plugin

From the plugin's [README](https://github.com/vaubaan/gateway/blob/main/plugins/context7/README.md), written for the people who register the app or create the token.

### Credential and resources

Kind `api-key`, one required secret field:

| Field     | Pattern                          | Purpose                                                              |
| --------- | -------------------------------- | -------------------------------------------------------------------- |
| `api_key` | `^ctx7sk-[A-Za-z0-9_-]{16,128}$` | A Context7 API key, created in the dashboard (API Keys). Shown once. |

A key reaches what its teamspace's policies allow and carries no permission
choice; usage is counted on the member who created it. It is sent as
`Authorization: Bearer <key>`, to the MCP server and to the REST API alike.

`verify` and `discoverResources` call `GET /v2/usage`, which Context7 does
not count as a request. A refused key (401) is reported at once and nothing
is stored. Discovery returns **one resource**: `ref` `docs`, "Context7
library index", with the teamspace's `plan` (`free`, `pro`, `enterprise`,
`payg`) in its metadata. The endpoint is not paginated. The ref is a constant
because no answer of Context7 identifies the teamspace; each connection has
its own resource.

Revoking: in the Context7 dashboard, API Keys. Revocation is immediate and
permanent. Context7 documents no revocation endpoint, so the gateway erases
its copy and revokes nothing.

**Recommended at Context7**: in the teamspace's library filter, keep to
verified libraries or a minimum trust score (answers are third-party text),
and on a paid plan set a spending limit (a mission's quota bounds the
mission, not the key).