Create an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP Tokens
Create MCP Token
Mint a token for an assistant or automation with an API key.
POST
/
api
/
v1
/
mcp
/
tokens
/
Create an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}The token is created as the person who created the API key. A full access token follows that
person’s permissions as they change; a scoped one may only name resources they can reach.
This token is scoped because it declares scope fields: it reaches every table and the whole semantic
layer the key’s creator can see, and only the five read tools listed. To create a full access token,
send only a
curl --request POST \
--url "https://api.nekt.ai/api/v1/mcp/tokens/" \
--header "x-api-key: YOUR_API_KEY" \
--header "Content-Type: application/json" \
--data '{
"description": "n8n reporting agent",
"all_tables": true,
"all_semantic_layer": true,
"tool_scope": ["get_semantic_context", "list_tables", "get_relevant_tables_ddl", "generate_sql", "execute_sql"]
}'
description. The token expires one year after creation.
Getting the secret: the reveal link
The response carries nobearer_token. It carries a reveal_url instead:
{
"id": "0f9c7e4a-...",
"description": "n8n reporting agent",
"reveal_url": "/api/v1/mcp/tokens/reveal/UGxhdGZvcm0.../",
"...": "..."
}
The reveal link needs a person. It resolves only in the browser session of the user who
created the API key; calling it with
x-api-key returns 401/403, and it works once. A
script can therefore mint the token unattended, but a human has to open the link to collect the
secret and paste it into the tool that will use it.This is deliberate: an MCP token lives up to a year, and returning it in an API response would
put it in whatever log, transcript or webhook payload the caller happens to keep.What an API key cannot do
| Delete a token | 403. Creating and rotating are reversible, deleting is not. Revoke from the MCP page. |
| See other people’s tokens | The listing shows only tokens created by the key’s own creator, stricter than that person’s own session, where an Owner or Admin sees every token in the workspace. |
| Bypass the creation role | If the workspace requires Admin to create MCP tokens, a key created by a member gets 403, exactly as that member would. |
| Read the scope pickers | GET /api/v1/mcp/tokens/available-scopes/ is not available to an API key. Take tool names from the tools reference and resource ids from /api/v1/tables/, /api/v1/secrets/, /api/v1/semantic-layer/documents/ and /api/v1/live-connections/. |
Related
- MCP token object: every scope field, and what each one covers.
- Rotate an MCP token: new secret, same token.
- Permissions: how full access and scoped tokens react to permission changes.
Authorizations
API Key authentication. Format: 'x-api-key: api_key'
Body
application/jsonapplication/x-www-form-urlencodedmultipart/form-data
Maximum string length:
80When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Response
201 - application/json
Maximum string length:
80When the token was last used to call the API, or null if it never was.
MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Tables (Expandable)
Was this page helpful?