Skip to main content
Glama

Mint Child Api Key

mint_child_api_key

Mint a short-lived child API key for a delegated subtask. The child can never exceed the calling key: requested scopes must be a subset of what the caller holds, its expiry is capped by the caller's, and it may never itself mint keys (delegation is exactly one level deep). A caller whose own scopes were never recorded explicitly cannot delegate at all until it rotates first. The child key is returned exactly once in the response and cannot be retrieved again; revoking the parent immediately revokes the child. Requires the keys:mint scope.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameNoLabel for the child key (default 'delegated key').
scopesYesScopes to grant the child. Must be a subset of the calling key's own scopes and may not include keys:mint.
expires_in_minutesNoChild lifetime in minutes (default 60, maximum 1440).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -{
      -  "additionalProperties": false,
      -  "properties": {
      -    "text": {
      -      "type": "string"
      -    }
      -  },
      -  "required": [
      -    "text"
      -  ],
      -  "type": "object"
      -}New value: +null
  2. Added

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations only indicate non-read-only, non-idempotent, non-open-world behavior, the description adds substantial behavioral detail: the child key is returned exactly once and cannot be retrieved again, revoking the parent revokes the child, and expiry is capped by the caller's. This goes well beyond what the annotations and schema provide, covering lifecycle and safety-relevant behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and purpose-driven, with each sentence contributing a distinct fact: purpose, delegation limits, delegation preconditions, one-time retrieval, parent-child revocation, and required scope. There is no filler or repetition of schematic details, and the core purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers all critical operational details an agent needs: authorization requirement, delegation depth, scope and expiry constraints, one-time child return, revocation semantics, and prerequisites. Nothing necessary to invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaningful cross-parameter context. It explains that scopes must be a subset of the caller's, excludes keys:mint, and couples expires_in_minutes to the caller's own expiry—semantic relationships the schema does not articulate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb–resource pairing: 'Mint a short-lived child API key for a delegated subtask,' which clearly identifies both the action and the object. It further distinguishes itself from related tools like rotate_api_key and get_api_key_info by emphasizing delegation constraints ('exactly one level deep,' 'may never itself mint keys,') and by stating it is the act of creating a child key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use conditions: use for delegated subtasks, require the keys:mint scope, and only when the caller's scopes are explicitly recorded. It also provides a when-not condition: a caller with unrecorded scopes cannot delegate until rotating first. It does not name a sibling alternative explicitly (e.g., rotate_api_key), but the context makes the intended usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources