---
title: "Issue Agenta Credential"
method: POST
path: "/gateways/mcps/credentials/agenta"
tags: ["Gateway: MCP"]
---

# Issue Agenta Credential

`POST /gateways/mcps/credentials/agenta`

Narrow an invocation credential to its resolved callback tools.

Three guards, because the value this hands back travels into a sandbox:

- Only the API-created service token contains ``gateway_run_id``.  Browser
  and API-key callers therefore cannot mint a credential for Agenta tools
  at all.
- The caller must hold the permission that governs SPENDING the MCP
  gateway, which is where the issued credential is spent
  (`MCPGatewayService.relay` authorizes the same one on every call). A
  credential can then never reach a plane its buyer could not reach.
- The tool list is bounded rather than signed as given
  (:func:`entitled_agenta_tools`): a credential already carrying a tool set
  may only narrow it, and one carrying none may still only name call_refs
  `POST /tools/call` would dispatch.

The issued value is confined to the gateway audience, like the one
`POST /gateways/credentials` hands the sandbox for every other MCP server.
That is what makes the bound hold: an audience-bound credential cannot reach
this route (it is not a data-plane path), so the narrowed credential can
never buy a wider one.

## Request body

- MCPAgentaCredentialRequest
  - `tools` MCPAgentaToolDescriptor[]
    - `name` string, required
    - `call_ref` string, required
    - `description` string, nullable
    - `input_schema` object

## Response `200`

Successful Response

- MCPAgentaCredentialResponse
  - `credentials` string, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-20** `7a4b57044657` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/agenta-ai/apis/agenta-api/changes/gateways/mcps/credentials/agenta/post.md)

---

[API](https://skmtc.dev/agenta-ai/apis/agenta-api.md) · [All operations](https://skmtc.dev/agenta-ai/apis/agenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agenta-ai/apis/agenta-api/revisions/72f2feba8ccb?raw)