MR Labs

API Tokens

Create and manage personal access tokens for API and MCP access to your organization's resources.

Personal Access Tokens

Personal access tokens allow you to authenticate with the MR Labs API and MCP server without using your password. Tokens are scoped to your organization and inherit your permissions.

Use tokens to:

  • Authenticate API requests to read and manage forms, quizzes, and games.
  • Connect an MCP client (e.g. Claude Desktop, Cursor) to the MR Labs MCP server.
  • Automate workflows via scripts or CI/CD pipelines.

Creating a Token

To create a new token:

1

Navigate to Settings > API Tokens and click Create token.

2

Enter a descriptive name for the token (e.g. ci-deploy or claude-mcp).

3

Click Generate. The full token string is shown once. Copy it immediately and store it securely.

Copy your token now

The full token is only displayed at creation time. After navigating away, you will only be able to see the token prefix. There is no way to recover a lost token.

Viewing Tokens

Existing tokens are listed in a table showing the following information:

  • Name: The label you assigned when creating the token.
  • Prefix: The first few characters of the token (e.g. mrl_abc12...). Used to identify which token is in use.
  • Created: The date and time the token was generated.
  • Last used: The most recent timestamp the token was used for authentication. Shows Never if unused.
claude-mcpmrl_abc12...
Created 2025-01-10Last used 2025-01-15 14:32
ci-deploymrl_xyz78...
Created 2024-12-20Last used 2025-01-14 09:15
local-devmrl_qrs45...
Created 2024-11-05Last used Never

Revoking a Token

To revoke a token, click Revoke next to the token in the list. Revocation is immediate and irreversible. Any application or script using that token will lose access instantly.

You should revoke a token if:

  • The token has been compromised or leaked.
  • The service or script using the token is being decommissioned.
  • A team member who had access to the token has left.

Security Warning

Treat tokens like passwords

  • Never commit tokens to version control or embed them in client-side code.
  • Store tokens in environment variables or a secrets manager.
  • Use a separate token for each integration so you can revoke individually.
  • Rotate tokens periodically as a precaution.

MCP Integration

To connect an MCP client to MR Labs, add the token to your client configuration. The token is passed as a Bearer header in the authorization header.

mcp_client_config.json

{
  "mrlabs": {
    "url": "https://api.mrlabs.dev/mcp",
    "headers": {
      "Authorization": "Bearer mrl_your_token_here"
    }
  }
}

For a full walkthrough of connecting MCP clients, see the MCP Integration Guide.

PreviousBrandingNextBilling