Search Console and Google Analytics come with your Google sign-in. Research is optional and uses a key from your own account, so the provider bills you directly for what you use.
What each key adds
| Provider | What it adds | Tool |
|---|---|---|
| DataForSEO or Ahrefs | Keyword metrics, ranked keywords, SERPs, competitors and backlinks | seo_research |
| Clicky | Visits by landing page, traffic sources and search engines | seo_data |
Clicky takes your Clicky account login, which adds every site, or one site at a time with its site ID and sitekey. The analytics guide explains both.
Research rows also get a free Domain Rating column, with no key needed. It is Domain Rating by Ahrefs.
Save keys on your account page
This works in every client, and you never paste a key into a chat.
- Open your account page and sign in with Google.
- Open the Keys tab. Enter the DataForSEO or Ahrefs keys you want and choose Save keys, or add your Clicky account or a Clicky site.
Saved keys are encrypted and never shown again. To change one, enter the new value and save. Remove these keys deletes the DataForSEO and Ahrefs keys, Remove next to a Clicky site deletes that site, and Remove account and its sites deletes the Clicky login and every site it added.
The CLI uses the same keys once you link it to your account with seo login.
Or send keys as headers
Clients such as Claude Code, Codex, Cursor and VS Code can send headers with each request. A header wins over a saved key. Headers suit cloud agents and CI, where nothing should be saved.
claude mcp add --transport http seoskill https://seoskill.dev/mcp \
--header "X-Ahrefs-Key: ${AHREFS_API_KEY}"
| Provider | Headers |
|---|---|
| DataForSEO | X-DataForSEO-Login, X-DataForSEO-Password |
| Ahrefs | X-Ahrefs-Key |
Keep keys in your shell environment or keychain, never in a chat or a repository file. On cloud agents and CI, put them in the platform secrets and follow the cloud agents guide.
How keys are handled
A saved key is encrypted before it is written and is used only for your own research requests. A key sent as a header is used for that request only and never saved. The what is stored page covers the rest.
When the hosted MCP needs a key it does not have, its message says where to add one.