Resource
Manage resource clients and the consents your end users grant against them
Use scalekit.resources to manage resource clients and to read and revoke the consents your end users grant against one. A consent records that one end user allowed a specific resource client to act on their behalf.
The same audit and revoke actions are available in the dashboard under Managing MCP clients.
getResource
Section titled “getResource”#asyncgetResource
Retrieves a single resource by id.
The resource to fetch (format: res_...).
Resource object.
const res = await scalekit.resources.getResource('res_xxx');console.log(res.resource);listResources
Section titled “listResources”#asynclistResources
Lists resources of a given type in the environment, with pagination.
The resource type to filter by. Supported value: ResourceType.MCP_SERVER.
Optional fields: pageSize (max 30), pageToken.
Paginated resources.
import { ResourceType } from '@scalekit-sdk/node';
const res = await scalekit.resources.listResources(ResourceType.MCP_SERVER, { pageSize: 20,});
for (const resource of res.resources) { console.log(resource.id, resource.scopes);}createResourceClient
Section titled “createResourceClient”#asynccreateResourceClient
Creates a resource client. Returns the created client and a plainSecret - the plaintext client secret, only available at creation time.
The resource to create the client for (format: res_...).
Optional client properties. name defaults to “Resource Client” if omitted. scopes should be the same or a subset of the scopes available for the resource. customClaims is a flat JSON structure only. expiry (access token lifetime in seconds) defaults to the resource’s configured expiry. redirectUris are the allowed redirect URIs for a pre-registered client.
The created client and its plaintext secret.
const resResource = await scalekit.resources.getResource('res_xxx');const allowedScopes = resResource.resource?.scopes.filter((s) => s.enabled).map((s) => s.name);
const res = await scalekit.resources.createResourceClient('res_xxx', { name: 'My Resource Client', scopes: allowedScopes,});
console.log(res.client?.clientId);// Store res.plainSecret in your secret manager now - it is never returned again.// It grants full access as this client, so if it leaks, replace it right away:// create a new secret and delete the compromised one (delete first if you're// already at your secret limit; if it's your only secret, raise the limit// before rotating).getResourceClient
Section titled “getResourceClient”#asyncgetResourceClient
Fetches a single resource client. For a DCR client, the response also includes the end-users who have granted it consent.
The resource the client must belong to (format: res_...).
The client ID (format: m2m_...).
The resource client.
const res = await scalekit.resources.getResourceClient('res_xxx', 'm2m_xxx');console.log(res.client?.name);listResourceClients
Section titled “listResourceClients”#asynclistResourceClients
Lists resource clients.
The resource whose clients to list (format: res_...).
The resource’s clients, plus totalDcrClients and totalStaticClients counts.
const res = await scalekit.resources.listResourceClients('res_xxx');
console.log(res.totalDcrClients, res.totalStaticClients);for (const c of res.clients) { console.log(c.clientId, c.name);}updateResourceClient
Section titled “updateResourceClient”#asyncupdateResourceClient
Updates a resource client.
The resource the client must belong to (format: res_...).
The client ID to update (format: m2m_...).
Fields to update - only fields present are changed. name/description are a no-op server-side when passed as an empty string, not a clear. scopes, customClaims, and redirectUris replace their existing values; pass an empty value ([] or {}) to clear one of them.
The updated client.
const resResource = await scalekit.resources.getResource('res_xxx');const allowedScopes = resResource.resource?.scopes.filter((s) => s.enabled).map((s) => s.name);
const res = await scalekit.resources.updateResourceClient('res_xxx', 'm2m_xxx', { name: 'Updated Name', scopes: allowedScopes,});
console.log(res.client?.name, res.client?.scopes);deleteResourceClient
Section titled “deleteResourceClient”#asyncdeleteResourceClient
Deletes resource clients. Throws if the client is missing or scoped to a different resource.
The resource the client must belong to (format: res_...).
The client ID to delete (format: m2m_...).
Empty response on success.
await scalekit.resources.deleteResourceClient('res_xxx', 'm2m_xxx');createResourceClientSecret
Section titled “createResourceClientSecret”#asynccreateResourceClientSecret
Creates a new secret for a resource client. Only 2 client secrets are recommended to exist at a given point in time - use deleteResourceClientSecret to remove an existing one first if you need more.
The plaintext client secret is only ever returned here, at creation time.
The resource the client must belong to (format: res_...).
The client ID to create a secret for (format: m2m_...).
The new secret, including its plaintext value.
const res = await scalekit.resources.createResourceClientSecret('res_xxx', 'm2m_xxx');// Store res.plainSecret in your secret manager now - it is never returned again.// It grants full access as this client, so if it leaks, replace it right away:// create a new secret and delete the compromised one (delete first if you're// already at your secret limit; if it's your only secret, raise the limit// before rotating).deleteResourceClientSecret
Section titled “deleteResourceClientSecret”#asyncdeleteResourceClientSecret
Permanently deletes a secret from a resource client. A client must always keep at least 1 secret - calling this on a client’s last remaining secret throws an error.
The resource the client must belong to (format: res_...).
The client ID the secret belongs to (format: m2m_...).
The secret ID to delete (format: sks_...).
Empty response on success.
await scalekit.resources.deleteResourceClientSecret('res_xxx', 'm2m_xxx', 'sks_xxx');listUserConsents
Section titled “listUserConsents”#asynclistUserConsents
Lists the end-user consents granted against a resource, with pagination. Use this to audit who authorized a client, and to find the consentId you need before revoking.
Filter by user in one of two ways. Pass userIds to match external user IDs exactly and case-sensitively. Pass search for a case-insensitive substring match. When you give both, userIds wins and search is ignored.
The resource whose consents to list (format: res_...).
Optional fields: search, pageSize (max 30), pageToken, userIds (max 25, takes precedence over search).
Consents with id, externalUserId, clientId, clientName, scopes, and grantedAt, plus totalSize and the nextPageToken / prevPageToken cursors.
const res = await scalekit.resources.listUserConsents('res_xxx', { pageSize: 20, userIds: ['user_456'], // optional; takes precedence over search});
console.log(res.totalSize, res.nextPageToken);for (const consent of res.consents) { console.log(consent.id, consent.externalUserId, consent.clientId, consent.scopes);}revokeUserConsent
Section titled “revokeUserConsent”#asyncrevokeUserConsent
Revokes a single end-user consent held by an API client. The client is prompted for consent again on its next authorization attempt, and every active refresh token issued to that client for the same user is revoked.
Access tokens that Scalekit already issued stay valid until they expire. See How revocation affects active access tokens for ways to shorten that window.
The API client that holds the consent (format: m2m_...), not the resource ID.
The consent to revoke (format: usrcnst_...), taken from listUserConsents.
Empty response on success. The call throws on failure.
await scalekit.resources.revokeUserConsent('m2m_xxx', 'usrcnst_789');