Token Management
Manage OAuth and Personal Access Tokens for MCP connections.
Token Types
Personal Access Tokens (PAT)
Created manually from Settings. Used for direct API access or MCP clients that do not support OAuth. Format: mrlabs_pat_...
OAuth Tokens
Issued automatically when a client like ChatGPT completes the OAuth flow. Named after the client that created them (e.g. "OAuth: ChatGPT"). Stored as PATs internally.
Managing Tokens
- All tokens are visible in Settings, API Tokens
- OAuth tokens are named after the client that created them
- Revoking a token immediately blocks all requests using it
- Tokens are scoped to your user account and respect your organization memberships
- PAT tokens are only shown once at creation time. Store them securely.
Scoping
All tokens inherit the permissions of the user who created them. There are no separate scopes for read vs write. If you can do it in the UI, the token can do it via MCP.
To limit access, create a separate user account with restricted organization memberships and generate a token for that account.
When to Revoke
- You accidentally shared a token
- A connected client is no longer trusted
- You want to force a client to re-authenticate
- You are rotating credentials for security