---
title: "Create an MCP API key for your organization."
method: POST
path: "/internal/api/mcp/keys"
tags: ["MCP CONNECTOR"]
---

# Create an MCP API key for your organization.

`POST /internal/api/mcp/keys`

## Request

- Base URL: `https://api.signalshq.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.signalshq.io/internal/api/mcp/keys`
- Auth: OAuth 2
  - Password
  - Token URL: `/auth/login`

Mint a key and return the plaintext.

``sha256(secret)`` drives authentication; a Fernet copy under a
tenant-derived key is stored alongside so the Owner can read the
credential back later. Several live keys per organization is
intentional: rotating means issuing a new key, moving the connector
over, then revoking the old one.

## Request body

- CreateApiKeyRequest
  - `label` string, required: How this key will be identified later, e.g. 'Perplexity — tax team'. The secret is never shown again, so the label is the only way to tell two keys apart when deciding what to revoke.
  - `expires_at` string, date-time, nullable: Optional expiry. Omit for a key that lasts until revoked.

## Response `201`

Successful Response

- CreateApiKeyResponse: The ONLY response that ever carries the plaintext key.
  - `api_key` string, required: The full credential. Copy it now — the Owner can read it back later from the key list, but nobody else can, and every read-back is recorded.
  - `key` ApiKeySummary, required: A key as an admin sees it. Never carries the secret.
    - `id` string, uuid, required
    - `key_id` string, required: Public half of the credential. Appears in server logs, so it is how you match a suspicious call back to one key.
    - `label` string, required
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `masked_key` string: ``elan_<key_id>_***`` — render this in the key list. Safe anywhere; the secret half is not in it.
    - `revealable` boolean: Whether the Owner can read this key back. False for keys minted before the reveal feature (no stored secret) and for revoked keys. Drive the reveal button off this rather than letting the user discover it by clicking.
    - `last_revealed_at` string, date-time, nullable
    - `revealed_by` string, nullable
    - `reveal_count` integer

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/signalshq/apis/signals-api.md) - [All operations](https://skmtc.dev/signalshq/apis/signals-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signalshq/apis/signals-api/revisions/2c22af3b5576?raw)