Create an MCP key

POST/v1/mcp-keys

Create an MCP key.

Creates a va_ key for agents to present to the MCP Gateway. It works only there (never on the VectorAxis API), it reaches the MCP servers of its workspace, and it may carry a tool allowlist and its own rate limits. The full key is returned once, in api_key; only its hash is stored.

Requires an organization admin key, or a workspace admin key for workspace_id. Returns 400 for an invalid or duplicate allowlist entry, or one naming a server outside the workspace. Returns 402 when the organization's plan does not include the MCP Gateway.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Request body application/json

the key to create

organizationstringrequired
The organization's identifier (slug).
At least 1 characters
workspace_idstring<uuid>required
The workspace the key belongs to (UUID). The key reaches only that workspace's MCP servers.
namestringrequired
Display name, up to 255 characters.
At least 0 characters · At most 255 characters
expires_atstring<date-time>
When the key stops working (ISO 8601). Absent: it does not expire.
tool_allowliststring[]
The tools the key may call, at most 500 entries: {server slug}/{tool name}, or {server slug}/* for every tool of that server. Each server must be in the key's workspace. Absent: every tool the registry allows. The allowlist can only narrow what the registry allows.
At most 500 items
rate_limit_rpminteger<int32>
Gateway calls per minute for this key (at least 1). Absent: only the plan's per-workspace limit applies.
Minimum 1
rate_limit_rpdinteger<int32>
Gateway calls per day for this key (at least 1). Absent: no daily limit of its own.
Minimum 1

Responses

201application/json

Created

keyobject
An MCP key: the va_ key an agent presents to the MCP Gateway. It works only on the gateway (an MCP server's URL and the gateway's own server), never on the VectorAxis API. The secret is returned once, when the key is created or rotated.
Child attributes
- idstring<uuid>
  The key's ID (UUID), used in the API paths.
- namestring
  Display name.
- organizationstring
  The organization that owns it.
- workspace_idstring<uuid>
  The workspace it belongs to (UUID).
- key_hintstring
  The last four characters of the key.
- statusstring
  ACTIVE or REVOKED.
- tool_allowliststring[]
  The tools it may call ({server slug}/{tool name} or {server slug}/*). Absent: every tool the registry allows.
- rate_limit_rpminteger<int32>
  Gateway calls per minute. Absent: only the plan's per-workspace limit.
- rate_limit_rpdinteger<int32>
  Gateway calls per day. Absent: no daily limit of its own.
- expires_atstring<date-time>
  When it stops working (ISO 8601). Absent: never.
- last_used_atstring<date-time>
  When it was last used on the gateway (ISO 8601).
- created_bystring
  The user who created it.
- created_atstring<date-time>
  When it was created (ISO 8601).
api_keystring
The full key (va_...). Shown only now: only its hash is stored, so store it safely.

Request

curl -X POST "https://api.vectoraxis.ai/v1/mcp-keys" \
  -H "Authorization: Bearer $VECTORAXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "organization": "string",
  "workspace_id": "3f6c1a2e-8b4d-4c1e-9a7f-2d5e6b8c9a01",
  "name": "string"
}'

VectorAxis is built by GK Labs, a member of NVIDIA Inception.