Workspace settings

Accounts and members

The first account becomes the workspace owner. Later accounts can join using an invitation link created by the owner from Settings. Invitations can be revoked; only the owner can invite or remove members. Workspace members share servers, variables, and secrets.

Server tokens

Create a server token in Settings → Server tokens when an endpoint should require bearer authentication. The generated token is shown only once; the database stores only its hash. Save it securely before closing the creation view.

A token can be assigned to one server at a time. Detach it before deletion or reassignment. Switching a server to normal access detaches its token. The token protects an MCP endpoint; it is not an account password or a workspace secret.

Variables and secrets

Workspace variables can hold shared configuration. Ordinary variable values are visible in Settings. Secret values are encrypted at rest and are never returned by the management API after saving; replace a secret with a new value to change it.

The deployment-managed WORKSPACE_SECRET_ENCRYPTION_KEY is required to save or use secrets. It must remain stable and backed up. Losing the key makes existing encrypted secrets unreadable.

Reference a value in a prompt or text resource as ${NAME}, or access it in a Python tool with os.environ["NAME"]. Current-workspace values are supplied to each tool call's isolated sandbox. A value referenced in a prompt or resource becomes part of the response and is visible to the requesting client.

Delete servers and files

Deleting a server permanently removes its tools, prompts, resources, and uploaded resource files. Its assigned server token is retained as an unassigned token. Workspace variables and secrets are not affected.

Deleting an individual binary resource also removes its stored file. Confirm the target before deleting; the removed content cannot be restored from MCPKite.