Make a delegated token for one MCP client

POST

/security/mcp/clients

A token (prorm_dt_…) a third-party MCP client holds: a subset of the
caller's capabilities, optionally locked to one database or store,
expiring in at most 30 days, never admin. The token is in this
response and nowhere else — only its hash is kept.

Checked in the route, in every enforcement mode: the caller is a
person's own session (bearer or Klock — not an api key, a guest or an
assumed identity) holding mcp:clients, and holds every capability it
delegates. Five live tokens per account (or the session kind's
concurrent limit): making another revokes the least recently used.

Capability: none from the table; any signed-in account, about itself. Mcp:clients, checked in the route.

Request

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

Made. token is shown once.

Headers

Bodyapplication/json

🟠400

🟠403

🟠404

🟠401KlockUnauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/mcp/clients' \
--header 'Content-Type: application/json' \
--data '{
    "clientName": "string",
    "label": "string",
    "caps": [
        "data:read"
    ],
    "resource": {
        "kind": "database",
        "id": 0
    },
    "expiresInDays": 30,
    "teamUuid": "dade4154-bf51-43f6-b351-602d59d37829"
}'

Response Example

201 - Example 1

{
    "token": "prorm_dt_8Qw…",
    "client": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "clientId": "5e505642-9024-474d-9434-e5a44f505cc5",
        "clientName": "string",
        "label": "string",
        "caps": [
            "string"
        ],
        "resource": {
            "kind": "database",
            "id": 0
        },
        "teamId": 0,
        "createdAt": "2019-08-24T14:15:22.123Z",
        "expiresAt": "2019-08-24T14:15:22.123Z",
        "lastSeenAt": "2019-08-24T14:15:22.123Z",
        "revokedAt": "2019-08-24T14:15:22.123Z",
        "revokedReason": "user"
    }
}

Modified at 2026-10-05 04:04:32

Release a member's lockdown

The account's delegated tokens