> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate MCP Token

> Issue a new secret for an existing token.

Rotating invalidates the previous secret immediately and keeps everything else about the token —
its description, its scopes, and the agents you have already authorized to use that token record.

Two rules worth knowing before you script this:

* **The expiration is preserved.** A rotation through an API key keeps the token's original
  deadline rather than restarting the term, so rotating often cannot turn a 1-year token into a
  perpetual one.
* **A token cannot rotate itself.** Rotating token A with token A's own credential returns `400`.
  An assistant rotating a *different* token on your behalf is fine — that is what this is for.

Like creation, the response carries a [`reveal_url`](/platform-api/mcp-tokens/create#getting-the-secret-the-reveal-link)
and no `bearer_token`, so a person has to open the link to collect the new secret.

```bash theme={null}
curl --request POST \
  --url "https://api.nekt.ai/api/v1/mcp/tokens/TOKEN_ID/rotate-credentials/" \
  --header "x-api-key: YOUR_API_KEY"
```


## OpenAPI

````yaml POST /api/v1/mcp/tokens/{id}/rotate-credentials/
openapi: 3.0.3
info:
  title: Nekt API
  version: v1
  description: Nekt API Documentation
  contact:
    email: support@nekt.ai
servers:
  - url: https://api.nekt.ai
security: []
paths:
  /api/v1/mcp/tokens/{id}/rotate-credentials/:
    post:
      tags:
        - v1
      summary: Rotate an MCP token
      description: >-
        Issues a new secret for an existing token, invalidating the previous
        one. A machine rotation keeps the token's original expiration date
        rather than renewing the term, and a token may never rotate itself.


        An `x-api-key` response never contains `bearer_token`. It carries
        `reveal_url` instead — a one-time link that only resolves in the browser
        session of the user who created the key, so the secret reaches a person
        and not a log. Everything else in the body is the token object.
      operationId: v1_mcp_tokens_rotate_credentials_create
      parameters:
        - in: path
          name: id
          schema:
            type: string
          required: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MCPToken'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/MCPToken'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/MCPToken'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MCPToken'
          description: ''
      security:
        - ApiKeyAuth: []
components:
  schemas:
    MCPToken:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        description:
          type: string
          maxLength: 80
        bearer_token:
          type: string
          readOnly: true
        expires_at:
          type: string
          format: date-time
          description: >-
            When the token stops working. Optional and create-only — omit it for
            the default 1-year lifetime. Must be in the future and at most 1
            year from now. Requires the mcp_token_custom_expiration feature
            flag.
        last_used_at:
          type: string
          format: date-time
          readOnly: true
          nullable: true
        use_created_by_permissions:
          type: boolean
        tool_scope:
          nullable: true
          description: >-
            Names of the native Nekt MCP tools this token may use. NULL = every
            tool available to the token's creator, future ones included; [] =
            none. Restricted tokens only — a full-access token always exposes
            its creator's whole surface.
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
        live_connection_scopes:
          type: array
          items:
            $ref: '#/components/schemas/MCPTokenLiveConnectionScope'
          writeOnly: true
        secret_scopes:
          type: array
          items:
            type: string
            format: uuid
          writeOnly: true
          nullable: true
          description: >-
            Ids of the secrets this restricted token may reference. Omit to
            inherit the creator's; [] for none.
        semantic_layer_scopes:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
              format: uuid
          writeOnly: true
          nullable: true
          description: >-
            Semantic Layer surface of this restricted token: {"folders": [...],
            "documents": [...]}. A folder covers its whole subtree, resolved at
            read time. Omit to inherit the creator's.
        table_scopes:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
              format: uuid
          writeOnly: true
          nullable: true
          description: >-
            Catalog links for the TABLES axis: {"layers": [...], "folders":
            [...], "tables": [...]}. A layer or folder link means everything
            inside it, now and in the future — tables only.
        volume_scopes:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
              format: uuid
          writeOnly: true
          nullable: true
          description: >-
            Catalog links for the VOLUMES axis: {"layers": [...], "folders":
            [...], "volumes": [...]}. The same layer linked here brings volumes
            only, never tables.
        all_tables:
          type: boolean
        all_volumes:
          type: boolean
        all_secrets:
          type: boolean
        all_semantic_layer:
          type: boolean
        all_live_connections:
          type: boolean
        mcp_config:
          type: string
          readOnly: true
          description: MCP Configuration (Field only visible on expanded view. Expandable)
        created_by:
          type: integer
          readOnly: true
          description: Created by (Expandable)
        tables:
          type: array
          items:
            type: string
          description: Tables (Expandable)
      required:
        - bearer_token
        - created_at
        - created_by
        - description
        - id
        - last_used_at
        - mcp_config
        - updated_at
    MCPTokenLiveConnectionScope:
      type: object
      properties:
        live_connection:
          type: string
          format: uuid
        tools:
          type: array
          items:
            type: string
          nullable: true
      required:
        - live_connection
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: 'API Key authentication. Format: ''x-api-key: api_key'''

````