Token Tools
Personal access tokens authorise every REST and MCP call, and the plaintext value exists exactly once.
Personal access tokens authorise every REST and MCP call, and the plaintext value exists exactly once. These tools list, mint and revoke tokens, so an agent can rotate the credentials it is given without a person opening the dashboard.
Tools
list_tokens
READList the authenticated user's own personal access tokens with abilities and scope tuples split out.
List the authenticated user's own personal access tokens with abilities and scope tuples split out. scope:team:... and scope:project:... entries are peeled off the raw abilities array into a structured scopes object for readability. The plaintext token value is never surfaced — minting happens in the dashboard.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
This tool takes no arguments.
What it returns
{ "data": [ { "id": "1284", "name": "Zapier production", "abilities": ["project:view-any", "project-user:view-any"], "abilities_count": 2, "scopes": { "team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86", "project_ids": ["7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13"] }, "last_used_at": "2026-05-18T09:15:00Z", "expires_at": null, "created_at": "2026-05-01T10:05:00Z" } ], "meta": { "total": 1 }}How it fails
AUTHENTICATION_REQUIREDno authenticated user on the request.
Related
revoke_token
DESTRUCTIVERevoke one of the authenticated user's own tokens by id. Self-revocation is refused.
Revoke one of the authenticated user's own personal access tokens by id. Refuses self-revocation — the token authenticating this call cannot delete its own row. Revoke the current session from the dashboard (Settings → API Tokens) or from a different token instead.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. Sending the same arguments twice changes nothing the second time.
Arguments
token_id*stringUUID of the token to revoke. Must belong to the authenticated user. Cannot be the id of the token authenticating this call.
What it returns
{ "data": { "token_id": "1284", "revoked": true }}How it fails
AUTHENTICATION_REQUIREDno authenticated user on the request.
VALIDATION_FAILEDtoken_id is empty, or caller tried to revoke the current session (self-revoke blocked).
RESOURCE_NOT_FOUNDtoken doesn't belong to the authenticated user.
Related
How is this guide?