Key Management
Create and list issuers with server-generated signing keys. Manage issuer policies, activate keys, and revoke keys. MCP does not import private keys or sign messages and tokens.
Activate a signing key.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
keyId | string | Yes | The ID of the pending signing key to activate. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Create a KMS issuer with server-generated signing keys for your team. Configure its name, signing algorithm, claims schema, and initial policy. MCP does not accept private-key imports.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Set requestBody.name when creating an issuer. You can also supply
algorithm, claimsSchema, and an initial policy inside requestBody.
The API generates the signing key. Do not send a PEM key or either import field.
Create an issuer policy.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Create a signing key.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Get an issuer.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
Retrieve the list of KMS issuers that belong to the authenticated team. The results are paginated.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
limit | integer | No | Maximum number of issuers to return. Minimum: 1. Maximum: 100. |
next | string | No | Continuation cursor to retrieve the next page of results. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
Revoke a signing key.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
keyId | string | Yes | The ID of the signing key to revoke immediately. The key must already be scheduled for revocation. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | unknown | No | Request body for this tool. |
Update an issuer.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Update an issuer policy.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
issuerId | string | Yes | The ID of the issuer. |
kind | string | Yes | The issuer policy kind. Value: "project-grant". |
policyKey | string | Yes | The policy identifier. |
teamId | string | No | Team ID to use for this operation. |
slug | string | No | Team slug to use for this operation. Use instead of teamId. |
requestBody | object | No | Request body for this tool. |
Was this helpful?