agentView

Create API Key

create_api_key

Creates a long-lived API key for server-to-server integration without OAuth. The raw key is returned only once — store it securely. The user must explicitly consent to creating the key. Requires admin scope. Supports granular scoping: restrict the key to specific data-slot slugs, specific display IDs, a read/write permission flag, and/or fine-grained capability flags.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`name`	Yes	Human-readable name for the key. Example: 'Home Assistant', 'CI Pipeline'.
`scope`	No	Scope for the key: 'content_only' (send content, list displays) or 'admin' (full management).	content_only
`org_id`	No	Optional organization ID. If set, the key acts on behalf of this organization.
`permissions`	No	Granular permission flag: 'read', 'write', or 'read_write' (default). Applied on top of 'scope' — e.g. a content_only read-only key cannot PUT data slots. Matched against HTTP verb: GET requires read, PUT/POST/PATCH/DELETE require write.	read_write
`access_token`	No	Optional bearer token; prefer session_request_id.
`capabilities`	No	Optional JSON array of fine-grained capability flags this key may exercise. Allowed values: 'slot.read' (list/get slots), 'slot.write' (put/delete slots), 'display.read' (list/get displays, read content), 'display.send' (send_html/send_url/broadcast/clear/set_idle), 'display.manage' (rename/delete/lock/configure/license/pair/claim/create). Omit or pass [] for no capability restriction. Capabilities narrow — never expand — the key's rights; they combine with scope, permissions, and resource whitelists.
`expires_in_days`	No	Optional expiration in days. If not set, the key never expires.
`allowed_slot_slugs`	No	Optional JSON array of data-slot slugs this key may touch (max 64). When set, every data-slot request must target one of these slugs. Omit or pass [] for no slug restriction. Example: ['sensor-lobby', 'sensor-garage'].
`session_request_id`	No	Session handle from create_auth_session; pass it on every authenticated call.
`allowed_display_ids`	No	Optional JSON array of display profile IDs this key may touch (max 64). When set, every display request must target one of these IDs. Omit or pass [] for no display restriction. Example: ['ABCD1234','EFGH5678'].

Output Schema

TableJSON Schema

Name	Required	Description	Default
`key`	No
`name`	No
`keyId`	No
`orgId`	No
`scope`	No
`warning`	No
`createdAt`	No
`expiresAt`	No
`permissions`	No
`capabilities`	No
`allowedSlotSlugs`	No
`allowedDisplayIds`	No

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed1 schema field changedAug 31, 2026

addedInput schema / properties / session_request_id

Added value: +{
+  "description": "Session handle from create_auth_session; pass it on every authenticated call.",
+  "type": "string"
+}

Changed1 schema field changedJul 6, 2026

changedInput schema / properties / access_token / description

Previous value: -"Optional JWT access token for authentication."New value: +"Optional bearer token; prefer session_request_id."

Changed17 schema fields changedJun 2, 2026

addedInput schema / properties / permissions / enum

Added value: +[
+  "read",
+  "write",
+  "read_write"
+]

addedInput schema / properties / scope / enum

Added value: +[
+  "content_only",
+  "admin"
+]

changedOutput schema / properties / allowedDisplayIds / items / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / allowedDisplayIds / type

Previous value: -"array"New value: +[
+  "array",
+  "null"
+]

changedOutput schema / properties / allowedSlotSlugs / items / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / allowedSlotSlugs / type

Previous value: -"array"New value: +[
+  "array",
+  "null"
+]

changedOutput schema / properties / capabilities / items / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / capabilities / type

Previous value: -"array"New value: +[
+  "array",
+  "null"
+]

changedOutput schema / properties / createdAt / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / expiresAt / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / key / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / keyId / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / name / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / orgId / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / permissions / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / scope / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / warning / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

Changed20 schema fields changedMay 23, 2026

removedInput schema / properties / access_token / default
```
Removed value: -null
```

changedInput schema / properties / access_token / type

Previous value: -[
-  "string",
-  "null"
-]New value: +"string"

removedInput schema / properties / allowed_display_ids / default
```
Removed value: -null
```

addedInput schema / properties / allowed_display_ids / items

Added value: +{
+  "pattern": "^[A-Z0-9]{8}$",
+  "type": "string"
+}

addedInput schema / properties / allowed_display_ids / maxItems
```
Added value: +64
```
addedInput schema / properties / allowed_display_ids / type
```
Added value: +"array"
```
removedInput schema / properties / allowed_slot_slugs / default
```
Removed value: -null
```
addedInput schema / properties / allowed_slot_slugs / items
```
Added value: +{
+  "type": "string"
+}
```
addedInput schema / properties / allowed_slot_slugs / maxItems
```
Added value: +64
```
addedInput schema / properties / allowed_slot_slugs / type
```
Added value: +"array"
```
removedInput schema / properties / capabilities / default
```
Removed value: -null
```

addedInput schema / properties / capabilities / items

Added value: +{
+  "enum": [
+    "slot.read",
+    "slot.write",
+    "display.read",
+    "display.send",
+    "display.manage"
+  ],
+  "type": "string"
+}

addedInput schema / properties / capabilities / type
```
Added value: +"array"
```
removedInput schema / properties / expires_in_days / default
```
Removed value: -null
```

changedInput schema / properties / expires_in_days / type

Previous value: -[
-  "integer",
-  "null"
-]New value: +"integer"

removedInput schema / properties / org_id / default
```
Removed value: -null
```

changedInput schema / properties / org_id / type

Previous value: -[
-  "string",
-  "null"
-]New value: +"string"

changedInput schema / properties / permissions / default
```
Previous value: -nullNew value: +"read_write"
```

changedInput schema / properties / permissions / type

Previous value: -[
-  "string",
-  "null"
-]New value: +"string"

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "allowedDisplayIds": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "allowedSlotSlugs": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "capabilities": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "createdAt": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "expiresAt": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "key": {
+      "type": "string"
+    },
+    "keyId": {
+      "type": "string"
+    },
+    "name": {
+      "type": "string"
+    },
+    "orgId": {
+      "type": "string"
+    },
+    "permissions": {
+      "type": "string"
+    },
+    "scope": {
+      "type": "string"
+    },
+    "warning": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

First observedMay 8, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the minimal annotations, the description discloses high-value behavioral traits: the raw key appears only once and must be stored securely, creation requires explicit user consent, and admin scope is required. This is exactly the kind of operational context an agent needs and cannot infer from the schema alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences front-load the purpose, then the critical security/authorization facts, then the scoping options. There is no filler and every sentence contributes meaning an agent needs before calling the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with a full output schema and minimal annotations, this description covers the non-obvious constraints: one-time secret, consent, admin scope, and the four scoping dimensions. The remaining details are safely carried by the 100%-covered schema and the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each of the 10 parameters is already well documented. The description summarizes the granular scoping model (data-slot slugs, display IDs, read/write flag, capability flags) and maps cleanly to the relevant parameters, but it does not add per-parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Creates a long-lived API key') and immediately distinguishes the tool from session-based alternatives by noting 'server-to-server integration without OAuth'. It also clarifies what kind of key is created and adds the meaningful constraint that the raw key is returned only once.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: use this for server-to-server integration without OAuth, with explicit user consent and admin scope required. It does not explicitly name alternatives like create_auth_session or say 'use X instead', but the context strongly implies the session-based sibling is not the right choice for long-lived integration keys.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All agentView tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0

Disambiguation4/5

Most tools map cleanly to distinct resource-action pairs (displays, organizations, assets, data slots, store templates, auth). A few clusters like the get_store_template_* family and the auth/session tools could still confuse an agent, but their descriptions are explicit enough to separate them.

Naming Consistency4/5

The dominant pattern is consistent verb_noun snake_case (list_*, get_*, create_*, delete_*, send_*, set_*, manage_*). Deviations like fetch, search, authenticate, logout, and pair_by_code are understandable but break the otherwise uniform naming scheme.

Tool Count1/5

With 57 tools this server far exceeds the 50+ threshold, creating an extreme tool-set size for an MCP server. Even though the underlying platform is feature-rich, the sheer number of tools heavily taxes context and selection.

Completeness4/5

The surface covers display, organization, asset, data slot, store template, auth, API key, and licensing lifecycles in impressive depth. Minor gaps exist, such as no delete operation for display categories and no reboot/power control for displays.

Resources

Need Help?