Create an MCP API key
Issues a key and returns it once. Store it on receipt: only the prefix and a hash are kept, so the raw value cannot be retrieved again.
A key is either client-scoped or agency-wide. Client-scoped is the default and fixes the key to one location. Pass agency_wide: true (or an explicit location_id: null) for a key that picks its client per session with list_clients / select_client.
curl -X POST "https://mythic-analytics.gulp.workers.dev/builder/mcp/api-keys" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-d '{
"name": "Reporting agent",
"location_id": "loc_abc123",
"agency_wide": false,
"scopes": [
"people:read",
"insights:read"
],
"rate_limit_per_minute": 60
}'
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/builder/mcp/api-keys"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
"name": "Reporting agent",
"location_id": "loc_abc123",
"agency_wide": false,
"scopes": [
"people:read",
"insights:read"
],
"rate_limit_per_minute": 60
}
response = requests.post(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/builder/mcp/api-keys", {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
},
body: JSON.stringify({
"name": "Reporting agent",
"location_id": "loc_abc123",
"agency_wide": false,
"scopes": [
"people:read",
"insights:read"
],
"rate_limit_per_minute": 60
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"name": "Reporting agent",
"location_id": "loc_abc123",
"agency_wide": false,
"scopes": [
"people:read",
"insights:read"
],
"rate_limit_per_minute": 60
}`)
req, err := http.NewRequest("POST", "https://mythic-analytics.gulp.workers.dev/builder/mcp/api-keys", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/builder/mcp/api-keys')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
"name": "Reporting agent",
"location_id": "loc_abc123",
"agency_wide": false,
"scopes": [
"people:read",
"insights:read"
],
"rate_limit_per_minute": 60
}'
response = http.request(request)
puts response.body
{
"data": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"agency_id": "123e4567-e89b-12d3-a456-426614174000",
"location_id": "loc_abc123",
"name": "Reporting agent",
"key_prefix": "mcp_3f9a1c0b",
"scopes": [
"people:read",
"insights:read"
],
"is_active": true,
"rate_limit_per_minute": 60,
"last_used_at": "2024-12-25T10:00:00Z",
"created_at": "2024-12-25T10:00:00Z",
"updated_at": "2024-12-25T10:00:00Z",
"key": "mcp_3f9a1c0b7e2d4a6f8b1c3d5e7f9a0b2c4d6e8f0a1b3c5d7e"
},
"warning": "Save this key now. It cannot be retrieved after this response."
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
/builder/mcp/api-keys
Target server for requests. Edit to use your own host.
An agency key (ak_). Location secret keys are rejected. Scoped keys (mcp_) are not accepted here (403 not_available_to_scoped_keys).
ak_). Location secret keys are rejected. Scoped keys (mcp_) are not accepted here (403 not_available_to_scoped_keys).The media type of the request body
Label shown in the key list.
Client to bind the key to. Defaults to the location bound to the request. Explicit null means agency-wide. Must belong to your agency.
Issue an unbound key that selects its client per session.
Scope strings (resource:read, resource:write, resource:*, or *). Omitted or empty means ["*"] — unrestricted. An empty array does not mean "no access"; to restrict a key, name the scopes it should have. Every string must be a scope from the catalog on the authentication page; a misspelled or retired scope answers 400 invalid_scope naming it, and is never stored.
Per-key request ceiling. Defaults to 60.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. An agency key (ak_). Location secret keys are rejected. Scoped keys (mcp_) are not accepted here (403 not_available_to_scoped_keys).
Body
Client to bind the key to. Defaults to the location bound to the request. Explicit null means agency-wide. Must belong to your agency.
loc_abc123Scope strings (resource:read, resource:write, resource:*, or *). Omitted or empty means ["*"] — unrestricted. An empty array does not mean "no access"; to restrict a key, name the scopes it should have. Every string must be a scope from the catalog on the authentication page; a misspelled or retired scope answers 400 invalid_scope naming it, and is never stored.
["people:read","insights:read"]