> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP token object

The credential an AI agent or automation uses to reach your workspace through the
[MCP Server](/mcp-server/introduction). An API key can mint, read, edit and rotate these — see
[Create an MCP token](/platform-api/mcp-tokens/create).

## The fields that decide what it reaches

| Field                                                                                    |                                                                                                                                                                                                          |
| ---------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `use_created_by_permissions`                                                             | `true` makes it a **full access** token: it follows the permissions of the person who created the API key, as those change. `false` makes it **scoped** — it carries its own selection, described below. |
| `tool_scope`                                                                             | Which MCP tools the token may call. Omit for all of them. Names come from the [tools reference](/mcp-server/tools); a name your MCP server version does not ship is stored and grants nothing.           |
| `table_scopes`, `volume_scopes`                                                          | Catalog links, as `{"layers": [], "folders": [], "tables": []}`. Linking a layer or folder means everything inside it, now and in the future.                                                            |
| `secret_scopes`                                                                          | Ids of secrets the token may reference.                                                                                                                                                                  |
| `semantic_layer_scopes`                                                                  | `{"folders": [], "documents": []}`. A folder covers its whole subtree.                                                                                                                                   |
| `live_connection_scopes`                                                                 | One entry per live connection, each with an optional `tools` subset.                                                                                                                                     |
| `all_tables`, `all_volumes`, `all_secrets`, `all_semantic_layer`, `all_live_connections` | Take a whole axis instead of selecting within it. On **Starter** and **Free** this is the only form of scoping available — see [Permissions](/mcp-server/permissions#scoping-on-starter-and-free).       |

Every axis is independent, and every one is narrowed on each request to what the API key's creator
can still reach. A scoped token can only ever be narrower than that person.

<Warning>
  `bearer_token` is **never** returned to an API key, on any of these endpoints. The secret is
  handed over through a one-time `reveal_url` that only opens in its creator's browser session.
</Warning>

## Related

* [Create an MCP token](/platform-api/mcp-tokens/create) · [Update](/platform-api/mcp-tokens/update) · [Rotate](/platform-api/mcp-tokens/rotate)
* [Permissions](/mcp-server/permissions) — full access vs scoped, and how each reacts to permission changes.
* [Tools](/mcp-server/tools) — the names `tool_scope` accepts.