Self-issued tokens
Create tokens on your own profile - no admin ticket, and no feature add-on needed. Name each one so you can revoke the right one later.
Developers · API Tokens & Scopes
Self-issued tokens that give integrations and AI exactly the access they need
Issue personal access tokens from your own profile - read-only or read-write - to connect the REST API or an AI assistant. A token acts as you, so it can never see or change more than you can, and every write it makes is audited.
- Free trial
- No credit card
- Free onboarding
Profile → Access TokensPinned to Acme Corp · Head Office
New token
Read-onlyRead-writeValid 30 days
••••••••••••••••••••••••7f3a
- Read-only
Claude (MCP)
Expires in 30 days
- Read-write
Warehouse sync
Expires in 18 days
- Read-only
Reporting script
Expires in 4 days
Token lifecycle
From issuance to revocation in five steps
- 01
Check workspace
The token is pinned to the company and organisation you are in.
- 02
Create
Profile → Access Tokens. Name it after where it will be used.
- 03
Choose access
Read-only unless the application must create or update records.
- 04
Configure the app
Send it as a bearer token from the REST API client or AI assistant.
- 05
Revoke
As soon as its purpose ends - don't wait for the 30-day expiry.
What token authentication gives you
Scoped, time-bound, auditable
Read-only or read-write
Choose per token. Read-write is re-checked against your own add and edit permission on every write.
30-day default validity
Tokens last 30 days by default. Issue a new one before expiry and update the application.
Write audit trail
Every write is logged to an append-only trail: who, token, action, record, outcome and field names - never values.
Pinned to one workspace
A token reaches only the company and organisation it was created in. Use one token per workspace.
Or sign in, for AI assistants
AI assistants can skip the token: add the MCP server address and sign in with your account (OAuth 2.1).
In detail
Scopes, expiry and audit
A personal access token is a credential you issue to yourself so an application can act on your behalf. It inherits your identity, your workspace and your permission scopes. A read-only token can only retrieve data. A read-write token can also create and update records, but read-write is a coarse ability on the token: every write is re-checked on the server against your own add and edit permission, so a token can never exceed what you are allowed to do. Each data type also stays gated by its add-on module - vendors, purchase orders, bills and payments need Purchase, and budgets need Budget.
- Read-only
- Read-write
- 30-day default
- One workspace per token
- Append-only audit
- REST API & MCP
Built in
- Valid for 30 days by default; issue a replacement before expiry and revoke the old one
- Pinned to the company and organisation active when it was created - switching workspace in the browser does not change it
- The audit trail records who acted, the token used, the action, the record, the outcome and the field names submitted, but never the field values
- Treat a token like a password: store it in the application or a password manager, never in a message or ticket
- Review and revoke a person's tokens when they leave, as part of your security process
Frequently asked questions
Issue your first token in under a minute
Start a free trial, open Profile → Access Tokens and connect your first integration or AI assistant.