Table of Contents

MCP Access Keys

MCP access keys let MCP-compatible AI assistants (for example Claude Desktop, ChatGPT, Cursor, or VS Code) connect to this server through the NovaBACKUP MCP server on your behalf. Every action performed with a key runs with your own permissions and tenant scope. The NovaBACKUP MCP server documentation lists the clients that have been tested, along with setup instructions for each.

To manage your keys, click on your user name in the navigation menu and select "MCP Access Keys".

Create a key

  1. Click "Create key" in the grid toolbar.
  2. Enter a label that identifies where the key will be used (for example "Claude Desktop on work laptop").
  3. Choose the scope:
    • Read-only (pre-selected): the key can query information but cannot start backups or change anything.
    • Read-write: the key can also trigger backups, change schedules, and perform other actions.
  4. If your account has two-factor authentication enrolled and the server policy requires it, enter a verification code from your authenticator app.
  5. Click "Create".

The key value is shown exactly once, immediately after creation. Copy it and store it securely; it cannot be retrieved again. Only a hash of the key is stored on the server.

Revoke a key

Click "Revoke" next to a key and confirm. Revocation takes effect within minutes; anything still using the key stops working.

The grid shows each key's label, scope, creation date, expiration date (if a maximum key lifetime policy is set), the last time it was used, and the IP address it was last used from. Review this information regularly to spot misuse.

Administration

Administrators can review any user's keys from the "MCP Access" tab on the user details page. From there an administrator can:

  • Revoke any of the user's keys.
  • Disable MCP access for the user entirely, which blocks both key creation and the use of existing keys.

Policy settings

The following server policies affect MCP access keys:

  • The MCP access keys feature can be enabled or disabled server-wide.
  • Two-factor enrollment can be required before a user may create keys.
  • A verification code (step-up) can be required at key creation for users with two-factor authentication enrolled.
  • A maximum key lifetime can be enforced, after which keys expire automatically.

When key creation is not possible, the page explains the reason. Existing keys stay listed so they can still be revoked.