# create_api_key Create a new API key Agent View of the PolicyLayer registry record for `create_api_key`. HTML page: https://policylayer.com/tools/instantkom-mcp-server/create-api-key ## Facts - Tool: `create_api_key` - Server: instantKOM MCP Server (`instantkom/mcp-server`) — https://policylayer.com/tools/instantkom-mcp-server.md - Homepage: https://github.com/instantKOM/mcp-server - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "create_api_key", "arguments": {} } } ``` ## Why create_api_key is rated Medium Creating an API key is a write operation that generates a new persistent credential for programmatic access. While reversible (keys can be deleted), the severity is elevated to 'high' because a compromised or misused API key grants unauthorized access to instantKOM resources and could enable lateral attacks, privilege escalation, or data exfiltration if an AI agent creates keys without proper oversight or shares… From the tool's own definition: "Tool name 'create_api_key' and description 'Create a new API key' indicate creation of a new authentication credential." ## Use case AI agents use create_api_key to create or update resources in instantKOM MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your instantKOM MCP Server environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches instantKOM MCP Server: ```json { "version": "1", "default": "deny", "tools": { "create_api_key": { "limits": [ { "counter": "create_api_key_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on instantKOM MCP Server (244) - `bulk_delete_custom_fields` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/bulk-delete-custom-fields.md - `delete_account` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-account.md - `delete_api_key` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-api-key.md - `delete_bot` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-bot.md - `delete_bot_env_var` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-bot-env-var.md - `delete_bot_env_var_value` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-bot-env-var-value.md - `delete_bot_filter` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-bot-filter.md - `delete_broadcast` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-broadcast.md - `delete_broadcast_media` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-broadcast-media.md - `delete_chat` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-chat.md - `delete_contact` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-contact.md - `delete_contact_custom_field_value` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-contact-custom-field-value.md - `delete_custom_field` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-custom-field.md - `delete_export` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-export.md - `delete_feed` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-feed.md - `delete_flow` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-flow.md - `delete_flow_edge` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-flow-edge.md - `delete_flow_node` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-flow-node.md - `delete_message` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-message.md - `delete_message_media` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-message-media.md - `delete_object_folder` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-object-folder.md - `delete_poll` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-poll.md - `delete_poll_option` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-poll-option.md - `delete_qr_code` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-qr-code.md - `delete_segmentation` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-segmentation.md - `delete_short_link` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-short-link.md - `delete_super_widget` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-super-widget.md - `delete_tag` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-tag.md - `delete_team_member_by_id` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-team-member-by-id.md - `delete_template` — Destructive — https://policylayer.com/tools/instantkom-mcp-server/delete-template.md - …and 214 more: https://policylayer.com/tools/instantkom-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=instantkom-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/instantkom-mcp-server