Rotate an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP Tokens
Rotate MCP Token
Issue a new secret for an existing token.
POST
/
api
/
v1
/
mcp
/
tokens
/
{id}
/
rotate-credentials
/
Rotate an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}Rotating invalidates the previous secret immediately and keeps everything else about the token —
its description, its scopes, and the agents you have already authorized to use that token record.
Two rules worth knowing before you script this:
- The expiration is preserved. A rotation through an API key keeps the token’s original deadline rather than restarting the term, so rotating often cannot turn a 1-year token into a perpetual one.
- A token cannot rotate itself. Rotating token A with token A’s own credential returns
400. An assistant rotating a different token on your behalf is fine — that is what this is for.
reveal_url
and no bearer_token, so a person has to open the link to collect the new secret.
curl --request POST \
--url "https://api.nekt.ai/api/v1/mcp/tokens/TOKEN_ID/rotate-credentials/" \
--header "x-api-key: YOUR_API_KEY"
Authorizations
API Key authentication. Format: 'x-api-key: api_key'
Path Parameters
Body
application/jsonapplication/x-www-form-urlencodedmultipart/form-data
Maximum string length:
80When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Response
200 - application/json
Maximum string length:
80MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Tables (Expandable)
Was this page helpful?