SCscalekit
MCP Configurations

Create an MCP session token for a connection

Changed on

Mints a short-lived token for one user that an MCP client sends to one connection's MCP server, at <environment URL>/mcp/v3/connections/{key_id}, without a Virtual MCP server. The token's sub claim is the identifier and its aud claim is that server URL, so the token works only there. Use it when an agent needs the tools of exactly one connection.

post/api/v1/mcp/connections/{key_id}/tokens

Request

Path parameters

key_idstring required

The connection name, as shown in AgentKit > Connections. It's also the last path segment of the connection's MCP server URL.

Request body

access_level'FULL' | 'READ_ONLY'

Which tools the token can use. READ_ONLY limits it to the server's read-only tools; other tools are left out of tools/list and refused when called. FULL, or omitting the field, gives every tool the server serves. Case-sensitive.

expirystring

Token lifetime, between 60s and 24h. Defaults to 1h.

identifierstring required

Your app's ID for the user, the same value you used when the user connected.

Example request

{
  "access_level": "READ_ONLY",
  "expiry": "3600s",
  "identifier": "user_123"
}

Response

Token created successfully; returns the signed JWT and its absolute expiry

expires_atstring date-time

Absolute time at which the token expires. Equals issued_at + expiry.

tokenstring

Signed JWT (RS256) whose sub claim is the supplied identifier and whose aud claim is the MCP server URL the token is scoped to: the MCP configuration's server URL for a configuration token, or the connection's <env_url>/mcp/v3/connections/{key_id} URL for a connection token. A configuration token also carries the MCP configuration ID (mcp_cfg); a connection token carries the connection ID (conn_id) instead. Both carry the resolved connected-account IDs (ca_ids). Signed with the calling environment's active JWT signing key.

Example response

{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNua18xMjMifQ.eyJhdWQiOlsiYWxpY2VAYWNtZS5jb20iXSwidG9rZW5fdHlwZSI6Im1jcF9zZXNzaW9uIn0.signature"
}

Changes