Ahrefs is an SEO intelligence platform for researching search performance, backlinks, keywords, and sites. Its hosted MCP server supports interactive OAuth, a manually generated MCP key, and—on Enterprise plans—an API key.
This guide prepares Ahrefs for an MCP client. The Ahrefs agent template is separate from vendor credential setup.
Choose a connection method
Ahrefs MCP is available on Lite plans and above. Choose OAuth for an interactive MCP client, an MCP key for a shared non-interactive connection, or an Enterprise API key only when that is the credential your plan permits. Ahrefs documents all three in its MCP guide.
Recommended: OAuth consent
OAuth is the normal hosted-MCP flow. It creates a dedicated API key with the MCP scope after the user approves consent.
- Add
https://api.ahrefs.com/mcp/mcpas the remote MCP server in an OAuth-capable client. - Sign in to the intended Ahrefs account, choose the intended workspace, and approve consent.
- In Ahrefs' API keys report, confirm the new key is tagged
MCPand set an appropriate per-key API-unit limit. - Query a known test property, then confirm that a property outside the intended account or project is unavailable.
Alternative: Manually generated MCP key
Use a manually generated MCP key for a shared, non-interactive connection.
- Generate an MCP key in Ahrefs for the intended account.
- Store it only in the MCP client's secret storage as
Authorization: Bearer <MCP key>. - Set a named owner, a rotation date, and a conservative API-unit limit.
Alternative: Enterprise API key
Enterprise customers can use an Ahrefs API key instead of an MCP key. API keys and MCP keys are not interchangeable, so configure the connection with the credential type you created and apply the same owner, usage-limit, and rotation controls.
Verify Ahrefs MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Ahrefs MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Ahrefs boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
Authentication errors often mean that the subscription does not include the requested API product. Successful authentication with unexpected data requires an account/project access review and credential rotation—not prompt-level filtering.
Next steps
Deploy the Ahrefs agent template to create a governed agent in Dome that can research search performance, backlinks, and keywords, with the template's included model, tools, and rules.
