MCP Gateway
ApiUser api keys

Rotate an API key

Rotate an API key by creating a new replacement key. The old key can optionally remain active for a grace period to allow smooth transition. The new key is returned only in this response.

POST
/api/v1/users/me/api-keys/{key_id}/rotate

Authorization

User API Key
AuthorizationBearer <token>

User API key (mgw_usr_live_* or mgw_usr_test_*)

In: header

Path Parameters

key_id*string
Formatuuid
access_token?|

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://loading/api/v1/users/me/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate" \  -H "Content-Type: application/json" \  -d '{}'
{
  "new_key": {
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "name": "string",
    "description": "string",
    "key_prefix": "string",
    "environment": "live",
    "scopes": [
      "string"
    ],
    "rate_limit_rpm": 0,
    "is_active": true,
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "expires_at": "2019-08-24T14:15:22Z",
    "last_used_at": "2019-08-24T14:15:22Z",
    "last_used_ip": "string",
    "key": "string"
  },
  "old_key_revoked": true,
  "grace_period_ends_at": "2019-08-24T14:15:22Z"
}
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Revoke an API key

Immediately and irreversibly revoke an API key owned by the authenticated user. An optional revocation reason can be provided for audit logging.

Create an HTTP Basic auth connection

Create an HTTP Basic auth connection to an MCP server. The password is encrypted at rest; the username is stored in plaintext for display. Credential fields in connection_data are rejected with 422.