> ## Documentation Index > Fetch the complete documentation index at: https://docs.nekt.com/llms.txt > Use this file to discover all available pages before exploring further. # Create MCP Token > Mint a token for an assistant or automation with an API key. The token is created **as the person who created the API key**. A full access token follows that person's permissions as they change; a scoped one may only name resources they can reach. ```bash theme={null} curl --request POST \ --url "https://api.nekt.ai/api/v1/mcp/tokens/" \ --header "x-api-key: YOUR_API_KEY" \ --header "Content-Type: application/json" \ --data '{ "description": "n8n reporting agent", "use_created_by_permissions": false, "all_semantic_layer": true, "tool_scope": ["list_tables", "execute_sql"] }' ``` ## Getting the secret: the reveal link The response carries **no `bearer_token`**. It carries a `reveal_url` instead: ```json theme={null} { "id": "0f9c7e4a-...", "description": "n8n reporting agent", "reveal_url": "/api/v1/mcp/tokens/reveal/UGxhdGZvcm0.../", "...": "..." } ``` **The reveal link needs a person.** It resolves only in the browser session of the user who created the API key — calling it with `x-api-key` returns `401`/`403`, and it works once. A script can therefore mint the token unattended, but a human has to open the link to collect the secret and paste it into the tool that will use it. This is deliberate: an MCP token lives up to a year, and returning it in an API response would put it in whatever log, transcript or webhook payload the caller happens to keep. ## What an API key cannot do | | | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Delete a token** | `403`. Creating and rotating are reversible, deleting is not. Revoke from the [MCP page](https://app.nekt.ai/mcp). | | **See other people's tokens** | The listing shows only tokens created by the key's own creator — stricter than that person's own session, where an Owner or Admin sees every token in the workspace. | | **Bypass the creation role** | If the workspace requires Admin to create MCP tokens, a key created by a member gets `403`, exactly as that member would. | | **Read the scope pickers** | `GET /api/v1/mcp/tokens/available-scopes/` is not available to an API key. Take tool names from the [tools reference](/mcp-server/tools) and resource ids from `/api/v1/tables/`, `/api/v1/secrets/`, `/api/v1/semantic-layer/documents/` and `/api/v1/live-connections/`. | ## Related * [MCP token object](/platform-api/mcp-tokens/mcp-token) — every scope field, and what each one covers. * [Rotate an MCP token](/platform-api/mcp-tokens/rotate) — new secret, same token. * [Permissions](/mcp-server/permissions) — how full access and scoped tokens react to permission changes. ## OpenAPI ````yaml POST /api/v1/mcp/tokens/ openapi: 3.0.3 info: title: Nekt API version: v1 description: Nekt API Documentation contact: email: support@nekt.ai servers: - url: https://api.nekt.ai security: [] paths: /api/v1/mcp/tokens/: post: tags: - v1 summary: Create an MCP token description: >- Mints a token for an assistant or automation. It is created **as the person who created the API key**: a full-access token (`use_created_by_permissions: true`) follows that person's permissions as they change, and a scoped one may only name resources they can reach. An `x-api-key` response never contains `bearer_token`. It carries `reveal_url` instead — a one-time link that only resolves in the browser session of the user who created the key, so the secret reaches a person and not a log. Everything else in the body is the token object. operationId: v1_mcp_tokens_create requestBody: content: application/json: schema: $ref: '#/components/schemas/MCPToken' application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/MCPToken' multipart/form-data: schema: $ref: '#/components/schemas/MCPToken' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/MCPToken' description: '' security: - ApiKeyAuth: [] components: schemas: MCPToken: type: object properties: id: type: string format: uuid readOnly: true description: type: string maxLength: 80 bearer_token: type: string readOnly: true expires_at: type: string format: date-time description: >- When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag. last_used_at: type: string format: date-time readOnly: true nullable: true use_created_by_permissions: type: boolean tool_scope: nullable: true description: >- Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface. created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true live_connection_scopes: type: array items: $ref: '#/components/schemas/MCPTokenLiveConnectionScope' writeOnly: true secret_scopes: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none. semantic_layer_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's. table_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only. volume_scopes: type: object additionalProperties: type: array items: type: string format: uuid writeOnly: true nullable: true description: >- Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables. all_tables: type: boolean all_volumes: type: boolean all_secrets: type: boolean all_semantic_layer: type: boolean all_live_connections: type: boolean mcp_config: type: string readOnly: true description: MCP Configuration (Field only visible on expanded view. Expandable) created_by: type: integer readOnly: true description: Created by (Expandable) tables: type: array items: type: string description: Tables (Expandable) required: - bearer_token - created_at - created_by - description - id - last_used_at - mcp_config - updated_at MCPTokenLiveConnectionScope: type: object properties: live_connection: type: string format: uuid tools: type: array items: type: string nullable: true required: - live_connection securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: 'API Key authentication. Format: ''x-api-key: api_key''' ````