---
title: "Exchange a one-time pairing code for a scoped API key"
method: POST
path: "/mcp/pair"
tags: ["Account"]
---

# Exchange a one-time pairing code for a scoped API key

`POST /mcp/pair`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/mcp/pair`
- Auth: none required

Device pairing, so a CLI or MCP client never has to have an API secret
pasted into it. The customer generates a short single-use code in the
clientarea; the tool posts it here and receives a freshly minted key
and secret, scoped and time-limited.

Unauthenticated by necessity — the code IS the credential — and
therefore throttled per IP. Codes are single-use and expire in
minutes; a spent or stale code returns `400`. The minted key carries a
finite `expires_at`, so a leaked paired credential ages out by itself.

## Request body

- object
  - `code` string, required: The pairing code shown in the clientarea. Single-use.
  - `label` string: Which tool is pairing, shown to the customer in their key list.

## Response `200`

Key minted. The secret is shown once.

- object
  - `success` boolean
  - `data` object
    - `api_key` string
    - `api_secret` string: Shown once. Not recoverable.
    - `scopes` string[]
    - `expires_at` string, date-time
  - `meta` Meta
    - `request_id` string
    - `timestamp` string, date-time

## Other responses

- `400`: Unknown, spent, or expired code
- `429`: Per-IP throttle reached

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)