---
title: "Ensure the tenant has a default read-only MCP API key"
method: POST
path: "/tenant/api-keys/ensure-default"
---

# Ensure the tenant has a default read-only MCP API key

`POST /tenant/api-keys/ensure-default`

## Request

- Base URL: `https://api.gravityads.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gravityads.dev/tenant/api-keys/ensure-default`
- Auth: HTTP bearer

## Request body

- object
  - `label` string: Display label for the default Portal quickstart key.
  - `ttl_days` integer
  - `scopes` string[]

## Response `200`

Default tenant MCP API key ready

- object
  - `status` 'tenant_api_key_default_created' | 'tenant_api_key_default_ready' | 'tenant_api_key_default_ensure_failed' | 'error', required
  - `tenant_id` string, required
  - `label` string, required
  - `key_id` string
  - `key_fingerprint` string
  - `fingerprint` string
  - `raw_key` string
  - `scopes` string[]
  - `hosted_auth_context` object
  - `key_created` boolean, required
  - `default_key_exists` true, required
  - `requires_rotation_for_reveal` boolean, required
  - `raw_key_returned` boolean
  - `raw_key_returned_once` boolean, required
  - `raw_secrets_returned` false, required

---

[API](https://skmtc.dev/gravityads/apis/gravityads-api.md) · [All operations](https://skmtc.dev/gravityads/apis/gravityads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gravityads/apis/gravityads-api/revisions/124cd07d534d?raw)