[enesgules]

Summary

• Docs (howto/api-keys, howto/admin-mcp): every API key can read the management API and use the Admin MCP read tools. The create-key box is now Write access (it was "Management access"), and only a key with it can make changes. The invite link needs it too. The anchor is now #write-access.
• Admin MCP: README, server card, landing page, and the hint for the new error code write_access_required (it was management_access_required).
• New screenshot /images/dashboard/api-key-write-access.png (the dialog with Write access ticked) replaces api-key-management-access.png.

Reviewer notes

• Deploy after upstash/context7app#1585, which returns the new error code.
• @upstash/context7-admin-mcp is private, so there is no changeset.

Part of CTX7-3507

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
context7-admin-mcp	Ignored		Nov 2, 2026 7:13am UTC

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
context7	🟢 Ready	View Preview	Oct 30, 2026, 1:15 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[linear-code]

CTX7-3507

[context7]

Docs7 for context7.com

Result	Status	Action
Deployment	✅ Ready	Open preview
Content review	✅ Passed. No problems found.	—

Commit 62afc52 · Updated 2026-11-02 07:14 UTC · View build details

[ramazanoacar]

Thanks, the docs, the README, the server card, the landing page and the hint for write_access_required all match the app change, and replacing the screenshot keeps the dialog and the docs in step.

I left a question on upstash/context7app#1585 about turning on read access for every existing key, since member emails, visitor conversations and deployment logs become readable with keys that were created only for docs. If that PR changes the default (for example, new keys only, or keeping personal-data reads behind Write access), the wording here ("every API key can read the management API") will need to follow it. So I'm holding off on approving until that settles. The rest looks ready.

[enesgules]

upstash/context7app#1585 keeps read access for every API key, including the existing ones (reasons in my reply there: https://github.com/upstash/context7app/pull/1585). So the wording here ("every API key can read the management API") stays as it is.

[ramazanoacar]

Thanks Enes, and thanks for the explanation on the app side. Keeping read access for every key is a fair call, especially since usage and policies were already readable with any key. The wording here matches that decision. I didn't find any "Management access" or management_access_required left in the docs or the Admin MCP. Approving 👍 (to merge after the app change is deployed, as the PR says).

Suggestion (non-blocking)

• This changes what existing keys can do, so it might be worth saying so in howto/api-keys under Write access: "This includes keys created before . A read-only key can read member emails, Ask and Docs7 conversations, and build logs, so revoke any key you no longer need." That way teams with older keys in CI or shared configs know to check them.