Create an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP Tokens
Create MCP Token
Mint a token for an assistant or automation with an API key.
POST
/
api
/
v1
/
mcp
/
tokens
/
Create an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}The token is created as the person who created the API key. A full access token follows that
person’s permissions as they change; a scoped one may only name resources they can reach.
curl --request POST \
--url "https://api.nekt.ai/api/v1/mcp/tokens/" \
--header "x-api-key: YOUR_API_KEY" \
--header "Content-Type: application/json" \
--data '{
"description": "n8n reporting agent",
"use_created_by_permissions": false,
"all_semantic_layer": true,
"tool_scope": ["list_tables", "execute_sql"]
}'
Getting the secret: the reveal link
The response carries nobearer_token. It carries a reveal_url instead:
{
"id": "0f9c7e4a-...",
"description": "n8n reporting agent",
"reveal_url": "/api/v1/mcp/tokens/reveal/UGxhdGZvcm0.../",
"...": "..."
}
The reveal link needs a person. It resolves only in the browser session of the user who
created the API key — calling it with
x-api-key returns 401/403, and it works once. A
script can therefore mint the token unattended, but a human has to open the link to collect the
secret and paste it into the tool that will use it.This is deliberate: an MCP token lives up to a year, and returning it in an API response would
put it in whatever log, transcript or webhook payload the caller happens to keep.What an API key cannot do
| Delete a token | 403. Creating and rotating are reversible, deleting is not. Revoke from the MCP page. |
| See other people’s tokens | The listing shows only tokens created by the key’s own creator — stricter than that person’s own session, where an Owner or Admin sees every token in the workspace. |
| Bypass the creation role | If the workspace requires Admin to create MCP tokens, a key created by a member gets 403, exactly as that member would. |
| Read the scope pickers | GET /api/v1/mcp/tokens/available-scopes/ is not available to an API key. Take tool names from the tools reference and resource ids from /api/v1/tables/, /api/v1/secrets/, /api/v1/semantic-layer/documents/ and /api/v1/live-connections/. |
Related
- MCP token object — every scope field, and what each one covers.
- Rotate an MCP token — new secret, same token.
- Permissions — how full access and scoped tokens react to permission changes.
Authorizations
API Key authentication. Format: 'x-api-key: api_key'
Body
application/jsonapplication/x-www-form-urlencodedmultipart/form-data
Maximum string length:
80When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Response
201 - application/json
Maximum string length:
80MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Tables (Expandable)
Was this page helpful?