---
title: "Ask a person to enter the API key of an existing MCP connection"
method: POST
path: "/v1/mcp-connections/{connectionId}/credential-prompt"
tags: ["Capability Sources"]
---

# Ask a person to enter the API key of an existing MCP connection

`POST /v1/mcp-connections/{connectionId}/credential-prompt`

## Request

- Base URL: `https://api.openworklabs.com`
- URL: `https://api.openworklabs.com/v1/mcp-connections/{connectionId}/credential-prompt`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Shows the person a private field in OpenWork for an existing API-key connection, so the key never passes through you. Use it to finish a connection still waiting for its shared key, to let the caller add or replace their own key (scope personal), or to let an owner or admin replace each person's own key with one shared key (scope shared on a personal-key connection; its ID and access stay, and nothing changes until they save a key that works). Changes nothing by itself.

## Path parameters

- `connectionId` string, typeid, required

## Request body

- object
  - `scope` 'shared' | 'personal'

## Response `200`

A private field is shown to the person.

- ExternalMcpConnectionCredentialPromptResponse
  - `connectionId` string, required
  - `scope` 'shared' | 'personal', required
  - `credentialPrompt` object, required
    - `schemaVersion` '1', required
    - `kind` 'credential_prompt', required
    - `target` union, required
      - object
        - `type` 'mcp_connection_key', required
        - `connectionId` string, required
      - object
        - `type` 'mcp_connection_member_key', required
        - `connectionId` string, required
      - object
        - `type` 'mcp_connection_shared_switch', required
        - `connectionId` string, required
        - `expectedUpdatedAt` string, date-time, required
        - `audience` object, required
          - `orgWide` boolean, required
          - `memberCount` integer, required
          - `teamCount` integer, required
      - object
        - `type` 'plugin_connection_key', required
        - `pluginId` string, required
        - `configObjectId` string, required
        - `serverName` string, required
        - `connectionId` string, required
      - object
        - `type` 'gateway_provider_key', required
        - `inferenceProviderId` string, required
        - `credentialSetId` string, required
      - object
        - `type` 'gateway_provider_credential', required
        - `inferenceProviderId` string, required
        - `credentialSetId` string, required
        - `credentialKind` 'aws_keys' | 'gcp_service_account' | 'api_key_map', required
        - `envNames` string[]
    - `name` string, required
    - `destination` string, nullable, required
  - `nextStep` string, required

## Other responses

- `400`: This connection does not take this kind of key.
- `401`: The caller must be signed in.
- `403`: The caller cannot enter this key.
- `404`: Unknown connection.
- `409`: A marketplace plugin manages this connection's key.

## Changes

- **2026-10-21** `8b797799efc8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/mcp-connections/:connectionId/credential-prompt/post.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) · [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openworklabs/apis/den-api/revisions/6b535fe28240?raw)