SCscalekit
MCP Configurations

Create an MCP session token

Changed on

Mints a short-lived JWT that represents a user identifier across the connected accounts associated with an MCP configuration. The supplied identifier becomes the token's sub claim; the token's aud claim is the MCP server URL bound to the configuration. Claims also carry the MCP configuration ID (mcp_cfg) and the list of resolved connected-account IDs (ca_ids). Use this operation to issue a single credential an MCP server can present on the user's behalf when calling provider tools. The mint fails if any connection mapped to the configuration has no active connected account for the identifier. For a META server, the user needn't have connected accounts yet.

post/api/v1/mcp/configs/{mcp_config_id}/tokens

Request

Path parameters

mcp_config_idstring required

Unique ID of the MCP configuration whose connections back the token. The configuration must exist in the caller's environment.

Request body

access_level'FULL' | 'READ_ONLY'

Which tools the token can use. READ_ONLY limits it to the server's read-only tools; other tools are left out of tools/list and refused when called. FULL, or omitting the field, gives every tool the server serves. Case-sensitive.

expirystring

Optional token lifetime. Must be between 60s and 24h. Defaults to 1h when omitted.

identifierstring required

Upstream-provider identifier (typically the user's email or provider user-id) shared by the connected accounts the token represents. A single identifier can map to one connected account per connection in the MCP configuration.

Example request

{
  "access_level": "READ_ONLY",
  "expiry": "3600s",
  "identifier": "alice@acme.com"
}

Response

Token created successfully; returns the signed JWT and its absolute expiry

expires_atstring date-time

Absolute time at which the token expires. Equals issued_at + expiry.

tokenstring

Signed JWT (RS256) whose sub claim is the supplied identifier and whose aud claim is the MCP server URL the token is scoped to: the MCP configuration's server URL for a configuration token, or the connection's <env_url>/mcp/v3/connections/{key_id} URL for a connection token. A configuration token also carries the MCP configuration ID (mcp_cfg); a connection token carries the connection ID (conn_id) instead. Both carry the resolved connected-account IDs (ca_ids). Signed with the calling environment's active JWT signing key.

Example response

{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNua18xMjMifQ.eyJhdWQiOlsiYWxpY2VAYWNtZS5jb20iXSwidG9rZW5fdHlwZSI6Im1jcF9zZXNzaW9uIn0.signature"
}

Changes