Rotate an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}MCP Tokens
Rotate MCP Token
Issue a new secret for an existing token.
POST
/
api
/
v1
/
mcp
/
tokens
/
{id}
/
rotate-credentials
/
Rotate an MCP token
curl --request POST \
--url https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/ \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": [
"<string>"
]
}
],
"secret_scopes": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}
'import requests
url = "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload = {
"description": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": True,
"tool_scope": "<unknown>",
"live_connection_scopes": [
{
"live_connection": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tools": ["<string>"]
}
],
"secret_scopes": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"semantic_layer_scopes": {},
"table_scopes": {},
"volume_scopes": {},
"all_tables": True,
"all_volumes": True,
"all_secrets": True,
"all_semantic_layer": True,
"all_live_connections": True,
"tables": ["<string>"]
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: '<string>',
expires_at: '2023-11-07T05:31:56Z',
use_created_by_permissions: true,
tool_scope: '<unknown>',
live_connection_scopes: [{live_connection: '3c90c3cc-0d44-4b50-8888-8dd25736052a', tools: ['<string>']}],
secret_scopes: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
semantic_layer_scopes: {},
table_scopes: {},
volume_scopes: {},
all_tables: true,
all_volumes: true,
all_secrets: true,
all_semantic_layer: true,
all_live_connections: true,
tables: ['<string>']
})
};
fetch('https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'description' => '<string>',
'expires_at' => '2023-11-07T05:31:56Z',
'use_created_by_permissions' => true,
'tool_scope' => '<unknown>',
'live_connection_scopes' => [
[
'live_connection' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'tools' => [
'<string>'
]
]
],
'secret_scopes' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'semantic_layer_scopes' => [
],
'table_scopes' => [
],
'volume_scopes' => [
],
'all_tables' => true,
'all_volumes' => true,
'all_secrets' => true,
'all_semantic_layer' => true,
'all_live_connections' => true,
'tables' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/"
payload := strings.NewReader("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nekt.ai/api/v1/mcp/tokens/{id}/rotate-credentials/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"<string>\",\n \"expires_at\": \"2023-11-07T05:31:56Z\",\n \"use_created_by_permissions\": true,\n \"tool_scope\": \"<unknown>\",\n \"live_connection_scopes\": [\n {\n \"live_connection\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"tools\": [\n \"<string>\"\n ]\n }\n ],\n \"secret_scopes\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"semantic_layer_scopes\": {},\n \"table_scopes\": {},\n \"volume_scopes\": {},\n \"all_tables\": true,\n \"all_volumes\": true,\n \"all_secrets\": true,\n \"all_semantic_layer\": true,\n \"all_live_connections\": true,\n \"tables\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "<string>",
"bearer_token": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"mcp_config": "<string>",
"created_by": 123,
"expires_at": "2023-11-07T05:31:56Z",
"use_created_by_permissions": true,
"tool_scope": "<unknown>",
"all_tables": true,
"all_volumes": true,
"all_secrets": true,
"all_semantic_layer": true,
"all_live_connections": true,
"tables": [
"<string>"
]
}Rotating invalidates the previous secret immediately. Every agent using it, including OAuth
connections built on it, stops working and must be reconnected with the new secret. The
description, scopes, and expiration date are kept.
Two rules worth knowing before you script this:
- The expiration is preserved. A rotation through an API key keeps the token’s original deadline rather than restarting the term, so rotating often cannot turn a 1-year token into a perpetual one.
- A token cannot rotate itself. Rotating token A with token A’s own credential returns
400. An assistant rotating a different token on your behalf is fine: that is what this is for.
reveal_url
and no bearer_token, so a person has to open the link to collect the new secret.
curl --request POST \
--url "https://api.nekt.ai/api/v1/mcp/tokens/TOKEN_ID/rotate-credentials/" \
--header "x-api-key: YOUR_API_KEY"
Authorizations
API Key authentication. Format: 'x-api-key: api_key'
Path Parameters
Body
application/jsonapplication/x-www-form-urlencodedmultipart/form-data
Maximum string length:
80When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Show child attributes
Show child attributes
Ids of the secrets this restricted token may reference. Omit to inherit the creator's; [] for none.
Semantic Layer surface of this restricted token: {"folders": [...], "documents": [...]}. A folder covers its whole subtree, resolved at read time. Omit to inherit the creator's.
Show child attributes
Show child attributes
Catalog links for the TABLES axis: {"layers": [...], "folders": [...], "tables": [...]}. A layer or folder link means everything inside it, now and in the future — tables only.
Show child attributes
Show child attributes
Catalog links for the VOLUMES axis: {"layers": [...], "folders": [...], "volumes": [...]}. The same layer linked here brings volumes only, never tables.
Show child attributes
Show child attributes
Tables (Expandable)
Response
200 - application/json
Maximum string length:
80When the token was last used to call the API, or null if it never was.
MCP Configuration (Field only visible on expanded view. Expandable)
Created by (Expandable)
When the token stops working. Optional and create-only — omit it for the default 1-year lifetime. Must be in the future and at most 1 year from now. Requires the mcp_token_custom_expiration feature flag.
Names of the native Nekt MCP tools this token may use. NULL = every tool available to the token's creator, future ones included; [] = none. Restricted tokens only — a full-access token always exposes its creator's whole surface.
Tables (Expandable)
Was this page helpful?