Manage encrypted tokens for Splunk MCP Server

Splunk MCP Server uses encrypted tokens to authenticate connections from MCP clients.

In Splunk MCP Server version 2.1.0 and higher, users with the required permissions can create and manage their own encrypted MCP tokens without requiring an administrator to create each token. Administrators can also manage tokens and encryption keys.

You can create, view, activate, deactivate, and delete encrypted MCP tokens by choosing Setting and then the Encrypted Tokens tab in the Splunk MCP Server app, as shown in the following image:

This image shows an example of the MCP Server app. The Setting option is selected from the left hand side menu and the Encrypted Tokens tab is highlighted.

Before you begin

To create and manage your own encrypted MCP tokens, you need the following permissions and configuration:

  • The mcp_edit_tokens_own capability in the Splunk MCP Server app.

  • The Splunk platform edit_tokens_own capability to create tokens for yourself.

  • Token authentication enabled on your Splunk platform instance.

The mcp_edit_tokens_own capability allows you to create, view, deactivate, and delete your own encrypted MCP tokens without requiring the mcp_tool_admin capability.

Non-administrator users can have up to three self-managed encrypted MCP tokens. Administrators can create tokens for other users and are not subject to this limit.

Create an encrypted MCP token

Complete the following steps:

  1. In the Splunk MCP Server app, select Setting, and then Encrypted Tokens.

  2. Select Create token.

  3. In the Create encrypted token window, configure the following fields:

    Field Description
    User The user associated with the token. For non-administrator users, this field is populated with their username and cannot be changed.
    Audience Identifies the service for which the token is intended. This value is fixed to mcp.
    Expires after Select when the token expires. Available options are 30 days, 60 days, 90 days, 120 days, or Custom.
    Valid after Select when the token becomes valid. Choose Immediately, a predefined period, or Custom to specify a date and time.

  4. Select Create.

  5. In the Encrypted token created window, select Copy token to copy the generated token. Store the token securely.
    Note: The token is displayed only once. You cannot view it again after closing the window.

  6. To configure your MCP client, expand How to set up your MCP client. The JSON configuration example includes the MCP Server endpoint and your newly generated token.

  7. Select the copy icon in the JSON configuration example section to copy the configuration.

  8. Add the copied configuration to your MCP client, making any adjustments required for your client and operating system. Save the configuration and restart the client.

  9. Select Close when done.

For additional instructions on configuring supported MCP clients, see Connecting to the MCP Server and settings.

View and manage encrypted MCP tokens

To view your encrypted MCP tokens, select Setting and then Encrypted Tokens.

The Your Encrypted MCP tokens table displays information about each token, including its name, status, username, audience, issue date, expiration date, and last-used information.

Use the search field to find a token.

Non-administrator users can manage their own encrypted MCP tokens. Administrators can manage tokens belonging to other users.

Activate or deactivate an encrypted MCP token

You can activate or deactivate an encrypted MCP token to control whether it can be used for authentication.

Complete the following steps:

  1. In the Splunk MCP Server app, select Setting, and then Encrypted Tokens.

  2. Locate the token you want to manage.

  3. Select the three-dot menu in the token's row.

  4. Select Deactivate for an active token, or Activate for a deactivated token.

Delete an encrypted MCP token

You can delete an encrypted MCP token when it is no longer needed. Deleting the token immediately invalidates it, and this action cannot be undone.

Complete the following steps:

  1. In the Splunk MCP Server app, select Setting, and then Encrypted Tokens.

  2. Locate the token you want to delete.

  3. Select the three-dot menu in the token's row.

  4. Select Delete.

  5. In the Delete token confirmation window, select Delete token to confirm the deletion.

Manage the encryption key

Administrators can view and manage the encryption key used for encrypted MCP tokens. Managing encryption keys requires the mcp_tool_admin capability.

To view the current key, select Setting and then Encrypted Tokens and expand the Encryption key section.

The section displays the key's status, fingerprint, creation date, and validity deadline.

Delete an encryption key

CAUTION: Deleting the encryption key immediately invalidates existing encrypted MCP tokens. There is no previous-key grace period. MCP clients using those tokens will need replacement tokens to reconnect.
Complete the following steps:

  1. In the Splunk MCP Server app, select Setting and then Encrypted Tokens.

  2. In the Encryption key section, select Manage key.

  3. Select Delete.

Key considerations

Keep the following considerations in mind when creating and managing encrypted MCP tokens:

  • Encrypted MCP tokens are intended for MCP authentication and cannot be used for direct Splunk API calls.

  • Token expiration and encryption-key validity are separate. A token can become unusable before its configured expiration if the encryption key is no longer valid.

  • Token values are displayed only once after creation. Store them securely.

  • The generated JSON configuration includes your encrypted MCP token. Treat the configuration as sensitive information and store it securely.

  • Tokens created outside the MCP Server app, or before token tracking was introduced, might not be available for management through the new interface.

  • To replace an expiring token, create a new token and update the MCP client configuration before the existing token expires.