Skip to main content
Glama

SpacePost

Create an API key

create_api_key

Create an API key.

The token is returned only in this response.

Requires a full_access API key. API: POST /api-keys (operationId createApiKey, API Keys).

Input Schema

NameRequiredDescriptionDefault
nameYes
domain_idNoRestrict a `sending_access` key to one of your domains. Not allowed with `full_access`.
permissionNofull_access

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and idempotentHint=false, so mutation and non-idempotency are already covered. The description adds context beyond that: the `token` is returned only in this response, which tells the agent the value cannot be retrieved later; and it notes the caller must hold a full_access key, which is an auth requirement not visible in the schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, front-loaded sentences. The single-use token warning comes early where an agent will see it. The trailing API/operationId metadata is boilerplate but not disruptive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description covers the most important return-value fact (the token is shown once and never again), plus the auth prerequisite. It is nearly complete for a three-parameter creation tool on a public API; only the permission/name parameter semantics are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only domain_id is documented, including the full_access incompatibility), so the description should compensate for `name` and `permission`, but it says nothing about them. Its mention of full_access describes the caller's own credential, not the `permission` parameter's accepted values or default, so the gap remains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Create an API key'), which is clearly distinct from list_api_keys and delete_api_key in the sibling set. It does not explicitly name those siblings, so it falls short of a 5, but an agent can identify the operation immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a prerequisite ('Requires a full_access API key'), which is genuinely useful for gating the call, but gives no guidance on when to choose this over alternatives or when not to create a key. Usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources