Access tokens

Create a token

Tokens live on your profile, so they follow you across every workspace you belong to.

1. Open the menu in the top-right corner of the dashboard and click Profile, then find the Developer section.
2. Click Access tokens, then New.
3. Give the token a name you will recognise later, such as the tool or machine that will use it.
4. Tick the scopes it needs.
5. Optionally tick the workspaces it may reach. Leave this blank to allow every workspace you belong to.
6. Click Create.

Scopes

Each tool requires at most one scope (the node-type reference needs none). Grant only the scopes your agent needs.

• read:knowledge, write:knowledge, delete:knowledge
• read:storage, write:storage, delete:storage
• read:flow, run:flow, write:flow, delete:flow, publish:flow, deploy:flow
• read:conversations, read:conversations_pii, debug:conversations

Read and run scopes suit an agent that answers questions and tries flows. Add write, publish, or deploy scopes only when the agent needs to change things. The Tool catalog lists the scope every tool requires.

Two scopes gate sensitive conversation data: read:conversations_pii reveals a contact's submitted email and phone, and debug:conversations exposes a run's raw step trace. Grant them deliberately.

Restrict to workspaces

By default a token can reach every workspace you belong to, and each call names the one it runs in. If you want a token pinned to specific workspaces, tick them when you create it. The list only ever offers workspaces you are a member of, and if your membership is removed the token loses that workspace with it.

Revoke a token

Open the token from the list and choose Revoke. It stops working immediately. The row stays so you can see when it was last used, but the token can no longer authenticate. Revoke a token the moment it is no longer needed or might have leaked.

Keep tokens safe

• Treat a token like a password. Anyone who has it can act as you, within its scopes.
• Give each agent or machine its own token, so you can revoke one without affecting the others.
• Grant the narrowest scopes and workspaces that get the job done.
• Store it in your agent's secret configuration, never in shared files or version control.