---
title: "Managing keys"
description: "Mint, scope, expire and revoke MCP keys from the standard Django admin — no external console."
source: "https://docs.blend-ed.com/openedx-mcp/keys/"
---

# Managing keys

The **Django admin is the key console** — no custom MFE, no external service.

## Mint a key
1. Django admin → **Open edX MCP → MCP keys → Add** .
2. Choose the **acting user** (must be `is_staff` / `is_superuser` ), a name, tick the [scopes](/openedx-mcp/security/) , optionally set an expiry.
3. Save. The raw key appears **once** in a success banner, together with
copy-paste [connect steps](/openedx-mcp/connect/) — the endpoint is filled in from `OPENEDX_MCP_PUBLIC_URL` .

Only a SHA-256 hash of the key is stored, so it can never be shown again. The row thereafter shows just a prefix.

## Expiry & revocation
- New keys inherit `OPENEDX_MCP_DEFAULT_KEY_TTL_DAYS` (90 by default) when you
leave expiry blank.
- Revoke instantly with the **Revoke selected keys** admin action — the next call
with that key fails.
- Because authority is re-checked live, removing the user’s `is_staff` / `superuser` also disables every key they hold, immediately.

## Audit
Every state-changing call is written to **MCP audit log** (append-only) before it executes — filter by key, tool or outcome in the admin.