---
title: "Rotate Mcp Token"
method: POST
path: "/api/users/{user_id}/rotate-mcp-token"
---

# Rotate Mcp Token

`POST /api/users/{user_id}/rotate-mcp-token`

## Request

- Base URL: `https://api.adplug.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.adplug.app/api/users/{user_id}/rotate-mcp-token`
- Auth: HTTP bearer

Regenerate the user's MCP URL-token.

Every MCP connection using the prior token URL stops working immediately.
The client is expected to refresh the user profile after a 200 response
and prompt the user to update their installed tools.

Note on the cooldown: enforced in-process via `_rotate_last_at`, so it's
per-Cloud-Run-instance rather than global. An authenticated user with
N instances in rotation could in theory burst through — tracked as a
follow-up (move to a DB-backed check with `profiles.mcp_token_rotated_at`).

## Path parameters

- `user_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/adplug/apis/adplug-api.md) · [All operations](https://skmtc.dev/adplug/apis/adplug-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adplug/apis/adplug-api/revisions/47dbef2d7c84?raw)