Create and revoke MCP keys

After signing in, open MCP keys. This account-level page works even before you have projects. Current source redirects the old /settings/api-keys route to it.

Create a key

Choose key creation and give the key a recognizable tool or purpose name.
Select the MCP purpose and either personal or project scope, depending on the access you need.
Select the minimum permissions and an expiry when offered by the UI.
Store the secret in the client’s secret storage as soon as it is shown. The metadata list does not recover the raw key.

Project-scoped keys can operate only within the corresponding project and cannot create new projects. Reading data does not automatically permit reading connection passwords: credentials:read is a separate sensitive permission.

Revoke or replace a key

Identify the correct key by its name, prefix and metadata. Review the target before revocation. Clients using it will need a replacement. If a key may be exposed, revoke it, create an appropriately scoped replacement and update clients. Do not paste the old key into a ticket as an explanation.

Resetting the console password does not automatically revoke MCP keys. Handle each at-risk key separately.

Administrative access

The admin page in current source allows authorized admin sessions to inspect metadata and revoke user keys. It does not recover plaintext/hashes, issue keys on another user’s behalf or edit key permissions there.

The new management routes have source changes dated 22 October 2026. This documentation task did not verify their live rollout.