# API tokens

How to create, copy and revoke tokens that let other tools read your workspace through the PYLO API and MCP server.

API tokens lets you issue a credential so a tool outside PYLO, such as Claude desktop or Zapier, can read your workspace's figures. The same token works for the REST API and the MCP server. For what you can do with a token, see [The PYLO API](/docs/api) and the [MCP server reference](/docs/mcp).

## Who can open it

Owners, admins and ops users. Anyone else is sent to their own board. A token can read everything in the workspace, so issuing one needs the same authority as reading everything in it.

## What a token can do

A token made on this page is read-only. It reads this workspace and no other, because the workspace comes from the token itself and there is no way to name a different one. It cannot write, create, delete or send anything. Filing a form through the API needs a member's own sign-in, and an agent's token can only propose a draft for a member to file.

## Create a token

1. Type a name in `Token name`. Name it after where it will live, such as "Claude desktop" or "ops laptop", so the list still makes sense months from now.
2. Choose `Create token`.
3. The token is shown once. Choose `Copy`, store it somewhere safe, then choose `I have it`.

PYLO does not store the token itself. It keeps a one-way hash and the first eight characters, so it can tell you which token is which, but nobody can read it back out, including PYLO. If you lose a token, revoke it and create a new one.

## Use a token

The card at the bottom of the page shows your workspace's addresses:

- REST: the `/api/v1/whoami` address, a quick way to check a token works.
- MCP: the `/mcp` address, with the token sent in an `Authorization: Bearer` header.

It also links to the API documentation, which lists every endpoint and the OpenAPI description tools can import.

## The token list

`In use` lists each live token with its name, its first eight characters, when it was created and when it was last used, or "never used". Check the last-used date before you revoke a token, so you know whether anything still relies on it.

## Revoke a token

Choose `Revoke` beside the token. It stops working and moves to `Revoked`, with the date it was revoked. Revoked tokens are kept rather than deleted, so that after an incident you can still see what a token was and when it was last used.

## What changes elsewhere

A new token lets its tool read your workspace straight away, and revoking one cuts that tool off. Nothing changes for your team inside PYLO.