PRODUCTION SCENARIO
An MCP server for a payments dashboard needs a user's payment-provider API key before it can issue refunds. The developer plans to collect the key with a form-mode elicitation/create call so the client renders a text field.
How must the server collect the key?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Use URL mode elicitation so the credential goes to a server-hosted page instead
The spec forbids form mode elicitation for secrets such as passwords, API keys, access tokens, and payment credentials, and requires URL mode for those interactions, so the credential is entered on a page the server controls and never passes through the MCP client or the model's context. The same page forbids putting sensitive data in the elicitation URL or handing the client a pre-authenticated URL.