Access tokens

Access tokens are workspace-scoped credentials for programmatic access — the MCP server and any other non-browser client authenticate with one. They behave like a session: a token carries the role you had when you created it, and every request it makes is scoped to its workspace and gated by the same permissions as the dashboard.

Create a token

1. Open Settings → Developer.
2. Give the token a name (e.g. "My laptop") and pick an expiry.
3. Click Create token.

The full token is shown once, at creation. Copy it then — it can't be retrieved again, only revoked. Treat it like a password.

A token looks like:

fbk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Use a token

Send it as a bearer credential:

Authorization: Bearer fbk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Manage tokens

The Developer panel lists your active tokens with their label, prefix, role, last-used time, and expiry. Revoke any token to kill it immediately — the next request it makes is rejected.

Good to know

• A token is bound to one workspace and carries a snapshot of your role at creation time.
• If you're removed from the workspace, the token stops working.
• Tokens are stored only as a hash — Feedbacks can't show you the value again, so rotate (revoke + create) if you lose it.