Issue MCP automation keys for team members

• You are a workspace admin or team admin. Non-admins can only create keys for themselves.
• The member the key will act as has an active seat in your workspace.
• The member is allowed to connect AI apps under Who can connect apps on the Thread MCP page. Issuing a key for a member who isn’t allowed fails. See Control who can connect AI apps to Thread MCP.

Decide which member the key should act as

• A read-only reporting job should bind to a member without write access.
• An automation that creates tickets needs a member who can create tickets in Inbox.

Issue the key in Thread Admin

1. Open Admin → Thread MCP, then the MCP keys tab.
2. Select Generate token.
3. Pick the member the key acts as, give the key a name (for example n8n production), and set an expiry. The expiry defaults to 90 days and can be at most one year out.
4. Select Create. Thread shows the key in plaintext exactly once, along with copy-ready setup snippets for Claude Code, Claude Desktop, Cursor, and a cURL verification call. Copy the key immediately and store it in your secrets manager; Thread keeps only a hash.

Issue the key with the API

{
  "name": "n8n ticket sync",
  "expires_at": "2027-03-01T00:00:00Z",
  "member_id": 4821
}

• name, a label for the key (1–100 characters). Name it after the automation that will use it, not the person.
• expires_at — when the key stops working. Required when issuing for another member, and it must be within one year. Requests without an expiry, or with one more than a year out, are rejected.
• member_id, the Thread member the key acts as. The member must belong to your workspace and be active; ids from outside your workspace fail validation. Omit member_id to create a key for yourself.

Use the key in your automation

curl -s -X POST https://api.getthread.com/mcp \
  -H "Authorization: Bearer mcp_YOUR_KEY_HERE" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Review and revoke keys

• Every key stores who issued it and when it was last used, so you can audit which admin created which credential and spot stale keys.
• The MCP keys tab on the Thread MCP page lists the keys you can manage. Select Revoke next to a key and confirm to disable it.
• Keys follow the same access setting as connected apps. When a workspace admin restricts Who can connect apps, keys bound to members who no longer pass are revoked right away, including keys an admin issued. Loosening the setting later doesn’t restore them; issue new keys instead.
• With the API, add ?scope=company to a GET /api/v1/mcp/tokens request to list keys beyond your own. Workspace admins see every key in the workspace. Team admins see keys bound to members on their teams, plus their own. Non-admins who request ?scope=company get a 403 error. Without the parameter, you see only your own keys.
• Revoke a key with DELETE /api/v1/mcp/tokens/{id}. Workspace admins can revoke any key in the workspace. Team admins can revoke keys bound to members on their teams, plus their own. Everyone else can revoke only their own keys. A key outside your scope returns a not-found error, so revoking it never confirms that it exists. Revocation is immediate, and revoking an already-revoked key returns an error rather than silently succeeding.
• Keys stop working the moment they expire or are revoked.

When to use OAuth instead