MCP keys
Mint, list and revoke MCP keys for one account's end user.
Guides: MCP for your users, MCP server.
| Method | Path | Operation | Scope |
|---|---|---|---|
GET | /v1/accounts/{accountId}/mcp-keys | List an account's MCP keys | admin |
POST | /v1/accounts/{accountId}/mcp-keys | Mint an MCP key for an account's user | admin |
DELETE | /v1/accounts/{accountId}/mcp-keys/{keyId} | Revoke an MCP key | admin |
Runs in your browser against api.workwae.com with the key you enter. Use a read-only key, limited to a test account if you can.
Newest first, without their secrets; revoked keys are left out.
Required scope: admin.
accountId*stringuuidOK
application/json- response
items*array<>curl -X GET 'https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys'{ "items": [ { "id": "c4e6a8b0-1d3f-4a5c-8e7b-9d1f3a5c7e9b", "name": "string", "prefix": "string", "scopes": [ "read" ], "accountId": "6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b", "expiresAt": "2026-05-04T09:30:00.000Z", "createdAt": "2026-05-04T09:30:00.000Z", "lastUsedAt": "2026-05-04T09:30:00.000Z", "sendPolicy": { "mode": "allow", "allowedRecipientDomains": [ "string" ], "dailySendLimit": 1, "externalRecipientConfirmation": true } } ]}Runs against the live API with the key you enter: this change really happens. Use a key limited to a test account.
The key is returned once; it is not retrievable later. It works only at the MCP server (mcpUrl, sent as Authorization: Bearer <key>), only for this account and with these scopes; every other route answers it with mcp_only_key. MCP clients that send a header take it (Claude Code, Cursor, Codex and the like); Claude.ai and ChatGPT custom connectors sign in with OAuth instead. Needs the admin scope and a key that is not bound to accounts. Revoked with the account when it is deleted.
Required scope: admin.
accountId*stringuuidapplication/json- body
name?string1 <= length <= 100"MCP"scopes*array<>1 <= itemsexpiresAt?|nullsendPolicy?|nullOK
application/json- response
id*stringuuidname*stringprefix*stringscopes*array<>accountId*stringuuidexpiresAt*|nullcreatedAt*stringdate-timelastUsedAt*|nullsendPolicy*|nullkey*stringmcpUrl*stringuricurl -X POST 'https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys' \ -H 'Content-Type: application/json' \ -d '{ "scopes": [ "read" ]}'{ "id": "c4e6a8b0-1d3f-4a5c-8e7b-9d1f3a5c7e9b", "name": "string", "prefix": "string", "scopes": [ "read" ], "accountId": "6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b", "expiresAt": "2026-05-04T09:30:00.000Z", "createdAt": "2026-05-04T09:30:00.000Z", "lastUsedAt": "2026-05-04T09:30:00.000Z", "sendPolicy": { "mode": "allow", "allowedRecipientDomains": [ "string" ], "dailySendLimit": 1, "externalRecipientConfirmation": true }, "key": "string", "mcpUrl": "https://app.example.com/"}Runs against the live API with the key you enter: this change really happens. Use a key limited to a test account.
The MCP server refuses the key from its next request on.
Required scope: admin.
accountId*stringuuidkeyId*stringuuidOK
application/json- response
curl -X DELETE 'https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys/5fe5a352-781d-4daa-a11d-c85fa8118da2'null