Managing keys

The Django admin is the key console — no custom MFE, no external service.

Mint a key

1. Django admin → Open edX Admin MCP → MCP keys → Add.
2. Choose the acting user (must be is_staff/is_superuser), a name, tick the scopes, optionally set an expiry.
3. Save. The raw key appears once in a success banner, together with copy-paste connect steps — the endpoint is filled in from OPENEDX_MCP_PUBLIC_URL.

Only a SHA-256 hash of the key is stored, so it can never be shown again. The row thereafter shows just a prefix.

Expiry & revocation

• New keys inherit OPENEDX_MCP_DEFAULT_KEY_TTL_DAYS (90 by default) when you leave expiry blank.
• Revoke instantly with the Revoke selected keys admin action — the next call with that key fails.
• Because authority is re-checked live, removing the user’s is_staff/superuser also disables every key they hold, immediately.

Audit

Every state-changing call is written to MCP audit log (append-only) before it executes — filter by key, tool or outcome in the admin.