For licensed Collaborators with permission for this task. Check the selected organisation; feature availability and record access still apply.
What you will achieve
Create an organisation-bound token for an approved API or MCP connection and revoke it safely when it is no longer needed.
Before you start
Use your own profile and confirm that the integration is authorised. Identify the target organisation and whether the client needs API, MCP, or both supported surfaces. A token is a credential: decide where it will be stored securely before creating it.
This guide covers Backstory token management. Installation and configuration of a particular external client need that client's approved instructions; do not copy an unverified configuration from a third party.
Create the token
- Open your own profile's API Tokens page.
- Review existing tokens and their organisation before creating another.
- Select Create Token.
- Give the token a recognisable purpose-specific name and select the correct Organisation.
- Select only the surface or surfaces required for this integration.
- Review the organisation and surface scope, then submit the creation form.
- In API Token Created, confirm the bound organisation. The plaintext credential is shown only once.
- Copy it into the approved secret store or client's credential field. If MCP is enabled, use the endpoint displayed by Backstory rather than inventing one.
- Close the secret-bearing result and test the connection with a minimal authorised read.
Never capture the plaintext-token result in a screenshot, commit it to Git or paste it into a conversation. Tokens do not justify giving an external agent broader authority than the task requires.
Change scope or revoke
Surface scope is fixed at creation. To change it, prepare a correctly scoped replacement and retire the old token through an approved handover.
Open the existing token's details and use its delete action. Read Delete API Token carefully: deletion immediately revokes access for automation using that token. Check the name and organisation before confirming Delete Token.
Check it worked
The new token's metadata appears under the expected organisation and the approved connection works. After revocation, the old token is absent and the affected integration can no longer use it. Do not interpret a successful connection as evidence that every API action is permitted.
If something goes wrong
| Problem | Next action |
|---|---|
| The secret was not saved | Revoke and recreate; do not expect to reveal it again |
| Wrong organisation or scope | Replace the token rather than broadening unrelated access |
| A token may have leaked | Revoke it promptly and follow your incident process |
| Automation fails after deletion | Identify the intended replacement; never restore a leaked secret |
Human judgement matters
MCP access can connect an AI client to organisational information and actions. Agree the client's boundaries separately from issuing its credential.
What next?
For the wider context, see Use collaboration and personal tools. Record the integration owner and review tokens when roles, devices or automation change.
Get help
Ask your Organisation Administrator about access or the task owner about the content. For a platform error, include this guide reference, the affected page and a sanitised message. Never share passwords, session details or confidential evidence in an open support request.