Connect your assistant to Render.

Use Render's MCP server when you want your coding assistant to inspect or manage services hosted on Render. This connects the assistant to your Render account; it does not supply a credential to the application you are building.

1. Choose how to connect

Start with browser authorization, also called OAuth. You sign in to Render and review access in your browser, without copying a token into Keyhole or the conversation. Use an API key only when your client or unattended setup needs one.

Agree on the workspace and task first. Render's tools can change services and start deployments. For an initial check, request only a service list. See Render's MCP instructions.

2. Authorize in your browser

Claude Code

1. In Claude Code, enter /plugin install render@claude-plugins-official.
2. Choose the plugin's installation scope, then run /reload-plugins. This choice concerns installation, not the Render resources you authorize.
3. Ask for the connection check below. On first use, complete Render's browser authorization. Check the account and requested access before approving.

For Codex, Cursor or Claude Desktop, follow Render's instructions for that client, then continue to the connection check.

Alternative: obtain an API key

1. Prepare the receiving configuration first.
2. Open Render's account settings, find the API keys area, and choose Create API Key.
3. Name the key for its use, such as assistant-on-my-laptop.
4. Copy the new value directly to the receiving field. The full key is displayed only when created.

See Render's key-creation walkthrough and API key documentation.

Put the key in the client's configuration

For a coding client, identify its exact credential destination using Assistant settings and Render's client instructions. Have your assistant prepare a placeholder configuration. Apply the file-access protections, then enter the value yourself.

Keep the real key out of assistant-run commands, chat, and shared files. Once the receiving file contains it, do not ask the assistant to open that file to check the edit.

Claude Code: reference the key by name

Prepare this project-root .mcp.json configuration while it contains only references. Merge the render entry with existing servers; do not replace the whole file if it already has settings.

{
  "mcpServers": {
    "render": {
      "type": "http",
      "url": "https://mcp.render.com/mcp",
      "headers": {"Authorization": "Bearer ${RENDER_API_KEY}"}
    }
  }
}

1. Leave ${RENDER_API_KEY} unchanged. Privately set env.RENDER_API_KEY in the project's .claude/settings.local.json, following the protected settings walkthrough. Enter the raw key, without a Bearer prefix.
2. Restart Claude Code in this project. Review its MCP approval request and approve the intended Render server. Then run the connection check below.

This combines Render's bearer-header authentication with Claude Code's documented variable references. The reference belongs in .mcp.json; the value belongs in private settings. It is a documentation-derived configuration, not an account-tested recipe.

3. Check the connection without exposing the key

Ask your assistant:

Use Render's MCP tools to list the workspaces I can access.
Let me choose the workspace, then list only its service names.
Do not deploy, change settings, read logs, or retrieve credentials.

Confirm the workspace before the service lookup. The assistant should use that workspace explicitly for the request, as described in the server's workspace reference. An empty list can be a successful result for a new workspace.

Success establishes access for that lookup, not permission for every later task. If it fails, share the client name and error category, without the key, configuration file, request headers, or raw debug log.

4. Remove or replace access

For an API key, revoke it in Render's account settings. Deleting its local copy does not revoke it. For a planned replacement, create a new key, update each client, verify, then revoke the old key. If exposed, revoke it first. See Render's key revocation instructions.

For Claude Code OAuth, open /mcp, select Render, and use Clear authentication; disable the server if you no longer want it available. See Claude Code's authentication controls. This review did not establish Render Dashboard clicks for revoking every issued OAuth token. Contact Render support if an OAuth credential may have been exposed.

For the assistant guiding this step

Present this guide through Porthole using the assistant handoff reference. Resolve authentication and destination before submitting a Keyhole request. OAuth needs no API-key request. For a key route, distinguish “saved locally,” “loaded by the client,” and “accepted by Render.”

Source notes

The Render CLI tutorial describes workspace-specific keys, while the API reference says keys access all of the user's workspaces. This guide uses the broader boundary and makes no promise of a workspace-restricted key. Sources were documentation-reviewed on 24 October 2026; account screens and connection flows still need a hands-on check.