---
title: "Read an MCP API key back (Owner only, audited)."
method: GET
path: "/internal/api/mcp/keys/{key_row_id}/reveal"
tags: ["MCP CONNECTOR"]
---

# Read an MCP API key back (Owner only, audited).

`GET /internal/api/mcp/keys/{key_row_id}/reveal`

## Request

- Base URL: `https://api.signalshq.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.signalshq.io/internal/api/mcp/keys/{key_row_id}/reveal`
- Auth: OAuth 2
  - Password
  - Token URL: `/auth/login`

Return the plaintext credential to the firm Owner.

OWNER-only, one role above the ADMIN who may manage the team: this
hands back a live credential that reads every client in the firm.

The audit stamp is written and COMMITTED BEFORE the plaintext is
returned. If that write fails the request fails and nothing is
disclosed — an unrecorded reveal is exactly the event the record
exists to capture, so it must not be possible to have one.

A revoked key is not revealable. Handing back a withdrawn credential
only invites it being pasted into a connector that will fail, and it
widens the window in which the plaintext exists for no benefit.

## Path parameters

- `key_row_id` string, uuid, required

## Response `200`

Successful Response

- RevealApiKeyResponse: Plaintext handed back to the Owner. Audited on the way out.
  - `api_key` string, required: The full credential. Treat every response carrying this as sensitive: do not log it, and do not cache it client-side.
  - `key` ApiKeySummary, required: A key as an admin sees it. Never carries the secret.
    - `id` string, uuid, required
    - `key_id` string, required: Public half of the credential. Appears in server logs, so it is how you match a suspicious call back to one key.
    - `label` string, required
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `masked_key` string: ``elan_<key_id>_***`` — render this in the key list. Safe anywhere; the secret half is not in it.
    - `revealable` boolean: Whether the Owner can read this key back. False for keys minted before the reveal feature (no stored secret) and for revoked keys. Drive the reveal button off this rather than letting the user discover it by clicking.
    - `last_revealed_at` string, date-time, nullable
    - `revealed_by` string, nullable
    - `reveal_count` integer
  - `reveal_count` integer, required: How many times this key has now been read back, including this one. Surface it — a credential revealed repeatedly is a different risk from one revealed once.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/signalshq/apis/signals-api.md) - [All operations](https://skmtc.dev/signalshq/apis/signals-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signalshq/apis/signals-api/revisions/2c22af3b5576?raw)