Changelog
New

Manage API keys from MCP with create_api_key

Create, list, and revoke organization API keys from OAuth-connected MCP sessions. Keys default to a 90 day expiry and every action is audit logged.

API

The remote MCP server at api.rendobar.com/mcp now carries three key management tools: create_api_key, list_api_keys, and revoke_api_key. An agent connected through the OAuth flow can take a user from nothing to a working integration in one conversation. Connect, run jobs on the session, and mint an API key only when code outside the session needs one, a CI pipeline, the SDK, or the CLI.

  • create_api_key returns the full key exactly once, the same contract as the dashboard. Keys default to a 90 day expiry. Non-expiring keys stay a dashboard decision.
  • list_api_keys returns names, prefixes, and expiry state. Key values are never included after creation.
  • revoke_api_key cuts access immediately.

The tools appear only in sessions authenticated through the OAuth flow, where a human approved the connection. Sessions authenticated with an API key do not see them, so a key can never be used to mint replacement keys. Creation and revocation are recorded in the organization audit log.

The same release fixes POST /api-keys for REST callers authenticated with an API key, which previously failed with a 500. Key creation now works from the dashboard, the REST API, and OAuth MCP sessions alike.

Setup for OAuth-capable clients is on the MCP page. How the OAuth connection itself works is covered in Connect the MCP server with OAuth.

Share