Sign in

v4

latestOpenAPI 3.1.1Apache 2.02026-07-31107278570.4 KB
MCP Configurations

Create an MCP session token

Mints a short-lived JWT that represents a user identifier across the connected accounts associated with an MCP configuration. The supplied identifier becomes the token's sub claim; the token's aud claim is the MCP server URL bound to the configuration. Claims also carry the MCP configuration ID (mcp_cfg) and the list of resolved connected-account IDs (ca_ids). Use this operation to issue a single credential an MCP server can present on the user's behalf when calling provider tools. The mint fails if any connection mapped to the configuration has no active connected account for the identifier.

post/api/v1/mcp/configs/{mcp_config_id}/tokens

Path parameters

mcp_config_idstring required

Unique ID of the MCP configuration whose connections back the token. The configuration must exist in the caller's environment.

Request body

expirystring

Optional token lifetime. Must be between 60s and 24h. Defaults to 1h when omitted.

identifierstring required

Upstream-provider identifier (typically the user's email or provider user-id) shared by the connected accounts the token represents. A single identifier can map to one connected account per connection in the MCP configuration.

Example request

{
  "expiry": "3600s",
  "identifier": "alice@acme.com"
}

Response

Token created successfully; returns the signed JWT and its absolute expiry

expires_atstring date-time

Absolute time at which the token expires. Equals issued_at + expiry.

tokenstring

Signed JWT (RS256) whose sub claim is the supplied identifier and whose aud claim is the MCP server URL bound to the configuration. Payload also carries the MCP configuration ID (mcp_cfg) and the resolved connected-account IDs (ca_ids). Signed with the calling environment's active JWT signing key.

Example response

{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNua18xMjMifQ.eyJhdWQiOlsiYWxpY2VAYWNtZS5jb20iXSwidG9rZW5fdHlwZSI6Im1jcF9zZXNzaW9uIn0.signature"
}