Sign in
latestOpenAPI 3.0.0raw.githubusercontent.com2026-08-1391215649.1 KB

64bfe76b130e

Personal Access Tokens

Create a personal access token

Mints a new personal access token for the caller. Deliberately not admin-gated — any authenticated org member may create their own, unlike OAuth app registration.

The token is minted against a lazily-created, per-org synthetic OAuth app (clientId: pat-system:<orgId>) shared by every PAT in that org — the same signing, hashing, and revocation machinery as /oauth2/token, reused rather than duplicated.

scopes is validated against the org's configured MCP_SCOPES env var, not the full role-aware OAuth-app scope catalog — a non-admin can request any scope in that set.

The response's accessToken is shown once; only its SHA-256 hash is stored. It's prefixed phpat_ (see the bearerAuth security scheme).

post/personal-access-tokens

Request body

namestring required

Label to help you recognize the token later

scopesstring[]

Scopes to grant, validated against the org's configured MCP_SCOPES (not the full role-aware OAuth-app scope set). Defaults to every scope in MCP_SCOPES if omitted.

Example request

{
  "name": "Claude Desktop",
  "scopes": [
    "kb:read",
    "semantic:write"
  ]
}

Response

Personal access token created successfully

messagestring required

Example response

{
  "message": "Personal access token created successfully",
  "token": {
    "accessToken": "phpat_eyJhbGciOiJIUzI1NiIs..."
  }
}