# Connect your assistant to Render.

Choose browser authorization or an API key, then give the Render MCP server the access it needs.

Use Render's MCP server when you want your coding assistant to inspect or manage services hosted on Render. This connects the assistant to your Render account; it does not supply a credential to the application you are building.

 

> Guide preview. Steps checked against official documentation on 24 October 2026; sign-in and connection checks have not yet been tested here.

 

## 1. Choose how to connect

 

Start with browser authorization, also called OAuth. You sign in to Render and review access in your browser, without copying a token into Keyhole or the conversation. Use an API key only when your client or unattended setup needs one.

 

Agree on the workspace and task first. Render's tools can change services and start deployments. For an initial check, request only a service list. See [Render's MCP instructions](https://render.com/docs/mcp-server).

 

## 2. Authorize in your browser

 

### Claude Code

 

1. In Claude Code, enter `/plugin install render@claude-plugins-official`.
2. Choose the plugin's installation scope, then run `/reload-plugins`. This choice concerns installation, not the Render resources you authorize.
3. Ask for the [connection check below](https://jlumbroso.github.io/keyhole-docs/render-mcp.html#verify-connection). On first use, complete Render's browser authorization. Check the account and requested access before approving.

 

For Codex, Cursor or Claude Desktop, follow [Render's instructions for that client](https://render.com/docs/mcp-server#1-connect-to-the-mcp-server), then continue to the connection check.

 

## Alternative: obtain an API key

 

1. Prepare the receiving configuration first.
2. Open [Render's account settings](https://dashboard.render.com/u/settings?add-api-key=), find the API keys area, and choose **Create API Key**.
3. Name the key for its use, such as `assistant-on-my-laptop`.
4. Copy the new value directly to the receiving field. The full key is displayed only when created.

 

See [Render's key-creation walkthrough](https://render.com/tutorials/render-with-ai-agents/install-the-plugin) and [API key documentation](https://render.com/docs/api#1-create-an-api-key).

 

> Treat this key as access to every Render workspace you belong to, as specified by [Render's API authentication reference](https://api-docs.render.com/reference/authentication). Choosing a workspace for an MCP operation does not restrict the credential itself. Do not describe the key as read-only or limited to one service.

 

## Put the key in the client's configuration

 

For a coding client, identify its exact credential destination using [Assistant settings](https://jlumbroso.github.io/keyhole-docs/assistant-settings.html) and Render's client instructions. Have your assistant prepare a placeholder configuration. Apply the [file-access protections](https://jlumbroso.github.io/keyhole-docs/keeping-secrets-out-of-the-conversation.html), then enter the value yourself.

 

Keep the real key out of assistant-run commands, chat, and shared files. Once the receiving file contains it, do not ask the assistant to open that file to check the edit.

 

### Claude Code: reference the key by name

 

Prepare this project-root `.mcp.json` configuration while it contains only references. Merge the `render` entry with existing servers; do not replace the whole file if it already has settings.

 

```
{
  "mcpServers": {
    "render": {
      "type": "http",
      "url": "https://mcp.render.com/mcp",
      "headers": {"Authorization": "Bearer ${RENDER_API_KEY}"}
    }
  }
}
```

 

1. Leave `${RENDER_API_KEY}` unchanged. Privately set `env.RENDER_API_KEY` in the project's `.claude/settings.local.json`, following [the protected settings walkthrough](https://jlumbroso.github.io/keyhole-docs/assistant-settings.html). Enter the raw key, without a ` Bearer  ` prefix.
2. Restart Claude Code in this project. Review its MCP approval request and approve the intended Render server. Then run the connection check below.

 

This combines [Render's bearer-header authentication](https://render.com/docs/mcp-server) with [Claude Code's documented variable references](https://code.claude.com/docs/en/mcp#environment-variable-expansion-in-mcpjson). The reference belongs in `.mcp.json`; the value belongs in private settings. It is a documentation-derived configuration, not an account-tested recipe.

 

> Keyhole currently writes the project's `.env`, not `.claude/settings.local.json`. Saving `RENDER_API_KEY` through Keyhole does not complete the settings step above. For now, that step is a private human edit. See [the destination distinction](https://jlumbroso.github.io/keyhole-docs/assistant-settings.html).

 

## 3. Check the connection without exposing the key

 

Ask your assistant:

 

```
Use Render's MCP tools to list the workspaces I can access.
Let me choose the workspace, then list only its service names.
Do not deploy, change settings, read logs, or retrieve credentials.
```

 

Confirm the workspace before the service lookup. The assistant should use that workspace explicitly for the request, as described in the [server's workspace reference](https://github.com/render-oss/render-mcp-server#workspaces). An empty list can be a successful result for a new workspace.

 

Success establishes access for that lookup, not permission for every later task. If it fails, share the client name and error category, without the key, configuration file, request headers, or raw debug log.

 

## 4. Remove or replace access

 

For an API key, revoke it in Render's account settings. Deleting its local copy does not revoke it. For a planned replacement, create a new key, update each client, verify, then revoke the old key. If exposed, revoke it first. See [Render's key revocation instructions](https://render.com/docs/api#1-create-an-api-key).

 

For Claude Code OAuth, open `/mcp`, select Render, and use **Clear authentication**; disable the server if you no longer want it available. See [Claude Code's authentication controls](https://code.claude.com/docs/en/mcp#authenticate-with-remote-mcp-servers). This review did not establish Render Dashboard clicks for revoking every issued OAuth token. Contact Render support if an OAuth credential may have been exposed.

 

## For the assistant guiding this step

 

Present this guide through Porthole using [the assistant handoff reference](https://jlumbroso.github.io/keyhole-docs/for-assistants.html). Resolve authentication and destination before submitting a Keyhole request. OAuth needs no API-key request. For a key route, distinguish “saved locally,” “loaded by the client,” and “accepted by Render.”

 

## Source notes

 

The [Render CLI tutorial](https://render.com/tutorials/render-cli-power-user/auth-and-workspaces) describes workspace-specific keys, while the API reference says keys access all of the user's workspaces. This guide uses the broader boundary and makes no promise of a workspace-restricted key. Sources were documentation-reviewed on 24 October 2026; account screens and connection flows still need a hands-on check.

## Chapter notes

**Before granting access**

An MCP server can act on your services. Review its permissions and approve only the task you intend.

**Documentation checked**

Official sources reviewed on 24 October 2026. This guide has not been tested against a signed-in account.

Keyhole 0.1.0 · previews labeled separately. Updated 24 October 2026. [Online chapter](https://jlumbroso.github.io/keyhole-docs/render-mcp.html). [Source reference](https://github.com/jlumbroso/keyhole/blob/main/docs/manual/content/render-mcp.html).

Source access currently requires a repository invitation.