.png)
ElevenLabs now ships one official MCP path, a hosted server with OAuth that centers on managing ElevenAgents, after deprecating its local server in August 2026. The REST API covers the full surface, from speech to text and dubbing to voice cloning, telephony and service accounts, behind an API key that can be scoped, capped and allowlisted. Both credentials carry spend. This guide compares what each path lets an agent do, the OAuth grant or key each one puts you on, and how to run a voice product for many customers in production.
Your agent needs to generate speech, manage voice agents, or mine call transcripts in your customers' ElevenLabs workspaces. ElevenLabs ships a hosted Model Context Protocol (MCP) server and a broad REST API. Until August 2026 there was also a local MCP server; it is now archived. The two remaining paths differ in what your agent can touch, how it authenticates, and who pays when a credential leaks. Here's how to pick.
The ElevenLabs hosted MCP server is a remote server operated by ElevenLabs at https://api.elevenlabs.io/v1/mcp, with data residency endpoints for the EU, India, and Singapore (for example https://api.eu.residency.elevenlabs.io/v1/mcp). ElevenLabs introduced it in August 2026 alongside a listing in Claude's connector directory, and setup instructions cover Claude, Claude Code, ChatGPT, Cursor, and other clients that accept a server URL and complete OAuth.
Auth is OAuth: the user signs in with their ElevenLabs account and grants scoped access to one workspace. No API key is copied into the client. Clients that support Client ID Metadata Documents (CIMD) need no manual client registration. ElevenLabs describes the tool set as intentionally scoped and curated for ElevenAgents, and does not publish a fixed list of tool identifiers; its own guidance treats the live tool list in your connected workspace as the source of truth.
The local elevenlabs-mcp server, which read ELEVENLABS_API_KEY from the client config and ran via uvx, was deprecated on August 22, 2026 in favor of the hosted server, and the repository was archived on August 20, 2026. Docs: Hosted MCP server and ElevenLabs MCP.
The REST API at https://api.elevenlabs.io/v1/ covers Text to Speech, Text to Dialogue, Speech to Text, voice changer, audio isolation, sound effects, music, dubbing, voices and voice cloning, pronunciation dictionaries, Studio projects, history, ElevenAgents (agents, conversations, knowledge base, tools, phone numbers, batch calling), workspace management, and service accounts.
Every request carries an API key in the xi-api-key header. Keys can be restricted to specific endpoint permissions, given a credit or character limit, and IP allowlisted. Service accounts give machine workloads an identity not tied to a human, and POST /v1/single-use-token/:token_type mints 15-minute, consumed-on-first-use tokens for frontend clients. Docs: API Authentication.
The pattern is clear. The hosted MCP server is an ElevenAgents operator's console: configure agents, test them, read their conversations, and generate a clip. The API is the production surface for everything that moves audio or money: transcription, dubbing, cloning, telephony, and workspace administration.
ElevenAgents configuration is deep. An agent carries a conversation config, voice settings, tools, knowledge base references, branches, and environment variables, and the REST payloads reflect that. The hosted MCP tools let a model compare configurations across agents, duplicate one for a new market, or adjust an opening message without your team writing schemas for any of it.
Writing the schema is the hard part. Not the API call.
The hosted server also gives workspace admins tool-level control: admins can configure the connector and its tools for the whole organization, a tool an admin disables cannot be re-enabled by an individual user, and users can only apply stricter settings. One sharp edge: updates made through the MCP server publish directly to the target branch, main by default, rather than staging a draft the way changes from the in-app ElevenAgents Architect do. An agent that edits a production voice agent through MCP edits production.
The MCP client opens ElevenLabs' OAuth flow, the user signs in, and the consent screen lists the requested permissions, which cover ElevenAgents read and write operations and Text to Speech. The grant is limited to the workspace the user signed in with, and the user can revoke it from the MCP client or from ElevenLabs account settings. Data residency environments are separate workspaces with separate accounts, so an EU customer signs in against the EU endpoint with an EU account.
What the user can't do, the agent can't do. Every MCP call acts inside one user's workspace grant, with whatever tools the workspace admin has left enabled.
There is no API key fallback on the hosted server. If your agent runs headless with no human present to complete a browser sign-in, the hosted MCP path is closed to you.
The API path is a single xi-api-key header, but the key itself is configurable in ways that matter for agents:
This is the blast radius point. An ElevenLabs API key is not just a data credential; it is a billing credential. A key with all permissions and no credit cap, stored in an agent's environment, lets a prompt-injected or looping agent clone voices, place outbound calls, or burn a customer's monthly credits. Least privilege on ElevenLabs means a scoped, capped key per user, not one workspace-wide key.
In a multi-tenant B2B agent, MCP's OAuth flow gives you a token per user. Direct API calls give you a credential per user. In neither case does the path itself solve storage, rotation, or revocation; those are infrastructure problems regardless of which path you choose.
ElevenLabs adds two wrinkles. Each credential is bound to one workspace and, for residency customers, one regional endpoint, so your credential store has to bind every token to its user, its workspace, and its region. And because credentials spend money, revocation is not just a security control; it is a cost control.
Recommended reading: OAuth vs API keys for AI agents
ElevenLabs owns the tool schemas, the curated tool set, and the server. You own the OAuth client, per-user token storage, refresh, and the reconnect experience when a user revokes access. You also own the consequences of direct publishing: since MCP updates land on the target branch immediately, any agent that writes through MCP needs its own guardrails before it touches a customer's live voice agent.
Migration is also on you. Teams that wired the local elevenlabs-mcp server into their stack with an API key now have to move to OAuth on the hosted server, and the auth model changes with it.
You own everything: schemas, pagination, retries, and the key lifecycle. The binding constraint is concurrency, not requests per minute. ElevenLabs publishes parallel request limits per plan: 2 on Free, 3 on Starter, 5 on Creator, 10 on Pro, and 15 on Scale and Business, with ElevenAgents on separate limits. Exceed it and you get HTTP 429 with too_many_concurrent_requests; the other 429 variant, system_busy, means ElevenLabs is under load and a retry usually succeeds. Your retry logic has to tell those apart: backing off on system_busy works, while retrying too_many_concurrent_requests without reducing parallelism just queues more failures.
List endpoints such as conversations paginate with cursor, next_cursor, and has_more. Paid requests fail once a key hits its character_limit. Key rotation is manual or scripted; ElevenLabs recommends overlapping keys for zero-downtime cutover and a routine 90-day rotation for backend keys.
On the MCP side, ElevenLabs controls the tool set and has already replaced one server with another in 2026; the hosted server's creative tools are still rolling out. Your agent's visible surface can change without a release on your side. On the API side, endpoints are versioned under /v1/, but ElevenAgents payloads gain fields frequently, and the tool schemas you write for them need to keep up.
Both paths hand you a credential per user. Neither hands you a vault. In a multi-tenant agent, 50 customers with 4 ElevenLabs users each is 200 credentials, spread across separate workspaces and possibly separate residency regions. Each one must be stored encrypted, bound to its user and workspace, rotated on its own schedule, and revoked when an employee leaves or a customer churns.
The token type changes between paths: an OAuth access token on MCP, a scoped xi-api-key on the API. The infrastructure does not change. The tempting shortcut, one unscoped workspace key per customer stored in your agent's config, collapses 200 credentials into 50 and turns each of those 50 into an uncapped billing credential that can act across the whole workspace.
Scalekit's ElevenLabs connector stores each user's ElevenLabs API key in the token vault and sends it with every call, so the MCP vs API decision doesn't change your auth infrastructure. Your agent passes an identifier; the key never enters the agent runtime or the LLM context.
Recommended reading: why a token vault matters for AI agent workflows
Scalekit's elevenlabs connector is an API-path connector with 119 tools (63 read, 40 write, 16 destructive). It authenticates with an API key: each user opens an authorization link once and enters their own ElevenLabs API key on a Scalekit-hosted page, and Scalekit stores it as that user's connected account credential. Ask users to create a key restricted to the permissions your agent needs, with a credit limit, rather than an all key.
Create an ElevenLabs connection in AgentKit > Connections in the Scalekit dashboard. The name you give it is the connection_name your code passes, and the string must match the dashboard exactly. This is the most common integration error. Copy SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID, and SCALEKIT_CLIENT_SECRET from Developers > API Credentials into .env.
get_or_create_connected_account returns the user's connected account. If it is not ACTIVE, get_authorization_link returns a link to the page where the user enters their ElevenLabs API key. The agent never sees the key.
This is not a catalog load. The agent asks for the tools this user's connected account is authorized to call, and narrows them to the five a call-quality review agent needs. Loading all 119 ElevenLabs tools would put elevenlabs_delete_agent, elevenlabs_start_twilio_outbound_call, and voice deletion in front of a model that has no reason to use them.
The loop runs until the model stops requesting tools. Every tool call executes with this user's ElevenLabs key, inside their workspace.
For pipelines, skip the model. execute_tool runs one tool with a fixed input and returns data plus an execution_id you can log.
elevenlabs_text_to_speech returns audio_base64 plus character-level alignment in the response body, so a pipeline can store or stream the audio without a second download step.
Scalekit does not ship a connector for ElevenLabs' hosted MCP endpoint. If you need endpoints outside the prebuilt tools, such as Speech to Text uploads or dubbing jobs, register a custom connector and make proxied calls through actions.request(), keeping the same connected account and vault model.
The elevenlabs connector has 119 tools. At roughly 200 tokens per tool definition, that is about 23,800 tokens of context before the agent does any work, and the model is choosing from a decision space that includes placing phone calls and deleting agents. The fix is not better prompting. It is surface reduction. A Scalekit virtual MCP server declares exactly which tools an agent role can see, and session tokens keep each run bound to one user's connected accounts. Docs: set up a virtual MCP server.
One server definition serves every user. Before each run, check that the user's accounts are active and mint a short-lived session token scoped to them. Any MCP client that speaks streamable HTTP can connect; this example uses langchain-mcp-adapters (pip install langchain-mcp-adapters) and passes the token as a Bearer header.
The agent sees four tools. The endpoint is static; the identity is per-user.
Every execute_tool call returns an execution_id, and every execution is attributed to a connected account, which maps to one of your users and one customer workspace. When a customer asks who placed a batch of outbound calls, which run regenerated a voice, or why their character count jumped overnight, the answer is a lookup, not an investigation.
Shared keys break this. If every user's agent runs on one workspace key, ElevenLabs history and usage show the key, and your side of the audit trail can only prove that the shared key did it. Shared credentials are a single-user solution. They do not survive a second user.
Recommended reading: audit trails for agent auth
If your agent is an interactive assistant in Claude, ChatGPT, Cursor, or Claude Code that helps a user configure, test, and review their ElevenAgents, use the hosted ElevenLabs MCP server. OAuth, workspace scoping, and admin-controlled tools get you there with no schema work, as long as you respect that MCP edits publish straight to the live branch. If your agent runs headless, transcribes or dubs audio, places calls, works with voices, or needs per-user spend caps, use the API directly.
Either way, the credential problem is the same, and that's what needs production-grade infrastructure. ElevenLabs credentials carry both data access and spend, and ElevenLabs has already replaced its MCP auth model once this year. The teams that bind every ElevenLabs credential to one user and one workspace now will absorb the next change without rewriting their agents.
Yes, one hosted server with OAuth, introduced in August 2026 with data residency endpoints for the EU, India and Singapore. The original local MCP server, which read an API key from the client config, was deprecated on August 22, 2026 and its repository archived. The hosted server centers on managing ElevenAgents, their tests and branches, plus speech generation, and ElevenLabs treats the live tool list in your workspace as the source of truth.
Speech to text, dubbing, voice design and cloning, pronunciation dictionaries, knowledge base management, outbound and batch calls over telephony, and service accounts with scoped keys. The MCP server's OAuth scopes cover ElevenAgents read and write operations and Text to Speech, and it has no API key fallback for headless use.
A key can be limited to specific endpoint permissions such as text to speech, speech to text, voice reads or agent reads and writes; given a credit or monthly character limit; and allowlisted to specific IP addresses. Service account keys belong to a non-human identity, and single-use tokens that expire after 15 minutes let a browser or WebSocket client work without ever seeing the long-lived key.
Updates publish directly to the target branch, main by default, rather than staging a draft the way changes from the in-app Architect do. An agent that edits a production voice agent through MCP edits production, so any write path through MCP needs its own guardrails. Workspace admins can disable tools for the whole organization, and users can only apply stricter settings.
When it runs headless, such as a nightly job that lists failed conversations and summarizes each one; when it places calls or produces audio at volume, paced against the plan's concurrency limit; when it needs capabilities the hosted server does not document; or when it needs hard spend and permission boundaries per user, since a restricted, capped key is a tighter credential than a broad OAuth grant.
The ElevenLabs connector exposes 119 tools over the REST API. Each user enters their own ElevenLabs API key once, ideally restricted and capped, Scalekit stores it in the token vault and sends it with every call, a virtual MCP server narrows a call-review agent to read tools so it cannot delete agents or place calls, and every execution is attributed to that user and workspace.
Browse the Scalekit ElevenLabs connector and the ElevenLabs connector docs with the full tool list. See Scalekit pricing, or talk to us.
