Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

Path Parameters

gateway_id
string<uuid>
required

Gateway id

Body

application/json

Auth to create

config
object
enabled
boolean
expires_at
string

ExpiresAt retires an api key on its own, as an RFC 3339 instant. Omitted or empty is no expiry, which is what every key was before the field existed.

name
string
type
string

Response

Created

api_key
string

#nosec G101

budget
object

Budget is the spending limit of a personal key. Absent means it has none.

config
object
consumers
object[]

Consumers are the consumers this auth reaches, which is what a caller needs before revoking one: a key can be attached to several, so disabling it stops more than the endpoint the reader was looking at. Empty means it reaches none, which is an answer rather than a gap.

created_at
string
enabled
boolean
expires_at
string

When the key retires itself. Absent means it never does.

gateway_id
string
group_id
string

GroupID is the directory group a group key is held for, which its spend is attributed to. Absent on the owner's personal key and on application keys.

group_name
string

GroupName is GroupID's directory name, which the MCP Store matches the key's access against. Absent wherever GroupID is.

id
string
key_prefix
string

Non-secret recognition hint for api_key auths (e.g. "ag_3dlXk" + "Rv8Q").

key_suffix
string
name
string
owner_email
string

OwnerEmail is the email of a personal key's owner, which the key's calls are shown under. Absent means none was recorded.

owner_groups
string[]

OwnerGroups are the directory groups of a personal key's owner, as the platform last reported them. Absent means none were reported.

owner_id
string
type
string
updated_at
string