API tokens
create_token, list_tokens and revoke_token — long-lived credentials for clients that cannot run the browser sign-in.
The normal way in is OAuth: the person signs in through the browser and the MCP client holds the session. Tokens exist for the cases where that is impossible — CI, cron, a script, any unattended client. A token acts as the user who minted it and never expires, so revoking is the only way to retire one.
Send it as a bearer header:
Authorization: Bearer <token>create_token
Mint a long-lived API token.
| Parameter | Type | Description |
|---|---|---|
name | string | Label to recognise the token by later, e.g. ci or deploy-bot. Defaults to api. |
Shown only once
The secret appears in this result and never again — list_tokens returns metadata only. Store it
when you create it, or mint a replacement and revoke the old one.
list_tokens
List your API tokens: label, prefix, whether each is active or revoked, and its id. Secrets are never shown again after creation.
Takes no parameters.
revoke_token
Revoke one of your customer's API tokens by id.
| Parameter | Type | Description |
|---|---|---|
token_id | uuid, required | Token id to revoke. |
Revoking cannot be undone; mint a new token instead.