Issue a separate credential for each client. Its workspace, capabilities, Actor allowlist, and expiry determine what it can do.
Steps
- In MCP access, choose a name, permissions, expiry, and all tracked Actors or a specific allowlist. Copy the raw secret when it is shown.
- Review last use and status. Edit permissions or Actor scope when the client's job changes, and revoke credentials you no longer need.
- Rotate an exposed credential, then immediately update the client. Rotate invalidates the old secret as soon as it succeeds.