Workwae
Request early access
Browse the docs

MCP keys

3 operations

List an account's MCP keys

get/v1/accounts/{accountId}/mcp-keys
SDK workwae.mcpKeys.list()

Newest first, without their secrets; revoked keys are left out.

Errors

StatusReasonWhen
404account_not_found
The account does not exist, or the caller is an account token for another account.

It can also answer the errors every operation can answer. Each error's reason is the body's code.

Parameters

NameInSchema
accountIdrequiredpath
string (uuid)

Responses

  • 200OK
    application/json
    McpKeyList
    • itemsarray of McpKey
      Item properties
      • idstring (uuid)
      • namestring
      • prefixstring
      • scopesarray of enum
        Item properties
        One of"read""write""send"
      • accountIdstring (uuid)
      • expiresAtstring (date-time) or null
      • createdAtstring (date-time)
      • lastUsedAtstring (date-time) or null
      • sendPolicyMcpSendPolicyPatch or null
        Properties
        • modeenumoptional
          One of"allow""confirm""drafts_only"
        • allowedRecipientDomainsarray of string or nulloptional
          1 to 100 items
        • dailySendLimitinteger or nulloptional
          1 to 10000
        • externalRecipientConfirmationbooleanoptional
    Headers
    • X-Request-IdstringThe request's id: the X-Request-Id you sent when it is 1 to 128 of A-Z a-z 0-9 . _ : -, else one the API generated.
    • RateLimit-LimitintegerRequests the tightest of the plan's per-minute windows (tenant, credential) admits.
    • RateLimit-RemainingintegerRequests that window still admits.
    • RateLimit-ResetintegerSeconds until that window ends.
curl -X GET "https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys" \
  -H "Authorization: Bearer $WORKWAE_API_KEY"

Mint an MCP key for an account's user

post/v1/accounts/{accountId}/mcp-keys
SDK workwae.mcpKeys.create()

The key is returned once; it is not retrievable later. It works only at the MCP server (mcpUrl, sent as Authorization: Bearer <key>), only for this account and with these scopes; every other route answers it with mcp_only_key. MCP clients that send a header take it (Claude Code, Cursor, Codex and the like); Claude.ai and ChatGPT custom connectors sign in with OAuth instead. Needs the admin scope and a key that is not bound to accounts. Revoked with the account when it is deleted.

Errors

StatusReasonWhen
404account_not_found
The account does not exist, or the caller is an account token for another account.
409mcp_key_limit
The account already has 25 live MCP keys; revoke one first.

It can also answer the errors every operation can answer. Each error's reason is the body's code.

Parameters

NameInSchema
accountIdrequiredpath
string (uuid)
Idempotency-Keyheader

Makes the request safe to retry: the first answer to the key is kept for 24 hours and answered again to the same request.

string
length 1 to 255

Request body

required
application/json
object
  • namestring
    Default "MCP"length 1 to 100
  • scopesarray of enumrequired
    at least 1 items
    Item properties
    One of"read""write""send"
  • expiresAtstring (date-time) or null
  • sendPolicyMcpSendPolicyPatch or null
    Properties
    • modeenum
      One of"allow""confirm""drafts_only"
    • allowedRecipientDomainsarray of string or null
      1 to 100 items
    • dailySendLimitinteger or null
      1 to 10000
    • externalRecipientConfirmationboolean

Responses

  • 201OK
    application/json
    CreatedMcpKey
    • idstring (uuid)
    • namestring
    • prefixstring
    • scopesarray of enum
      Item properties
      One of"read""write""send"
    • accountIdstring (uuid)
    • expiresAtstring (date-time) or null
    • createdAtstring (date-time)
    • lastUsedAtstring (date-time) or null
    • sendPolicyMcpSendPolicyPatch or null
      Properties
      • modeenumoptional
        One of"allow""confirm""drafts_only"
      • allowedRecipientDomainsarray of string or nulloptional
        1 to 100 items
      • dailySendLimitinteger or nulloptional
        1 to 10000
      • externalRecipientConfirmationbooleanoptional
    • keystring
    • mcpUrlstring (uri)
    Headers
    • X-Request-IdstringThe request's id: the X-Request-Id you sent when it is 1 to 128 of A-Z a-z 0-9 . _ : -, else one the API generated.
    • RateLimit-LimitintegerRequests the tightest of the plan's per-minute windows (tenant, credential) admits.
    • RateLimit-RemainingintegerRequests that window still admits.
    • RateLimit-ResetintegerSeconds until that window ends.
    • Idempotent-Replayedconstanttrue when this is the kept answer to an earlier request with the same Idempotency-Key.
curl -X POST "https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys" \
  -H "Authorization: Bearer $WORKWAE_API_KEY" \
  -H "content-type: application/json" \
  -d '{
  "scopes": [
    "read"
  ]
}'

Revoke an MCP key

delete/v1/accounts/{accountId}/mcp-keys/{keyId}
SDK workwae.mcpKeys.delete()

The MCP server refuses the key from its next request on.

Errors

StatusReasonWhen
404account_not_found
The account does not exist, or the caller is an account token for another account.
404mcp_key_not_found
The account has no live MCP key with this id.

It can also answer the errors every operation can answer. Each error's reason is the body's code.

Parameters

NameInSchema
accountIdrequiredpath
string (uuid)
keyIdrequiredpath
string (uuid)

Responses

  • 204OK

    No body.

    Headers
    • X-Request-IdstringThe request's id: the X-Request-Id you sent when it is 1 to 128 of A-Z a-z 0-9 . _ : -, else one the API generated.
    • RateLimit-LimitintegerRequests the tightest of the plan's per-minute windows (tenant, credential) admits.
    • RateLimit-RemainingintegerRequests that window still admits.
    • RateLimit-ResetintegerSeconds until that window ends.
curl -X DELETE "https://api.workwae.com/v1/accounts/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b/mcp-keys/6f1c2a4e-8b3d-4e5f-9a7b-1c2d3e4f5a6b" \
  -H "Authorization: Bearer $WORKWAE_API_KEY"