API tokens

Any active member can open Settings, then API tokens, and can see the tokens they created. An admin sees every token in the workspace. The heading is API tokens.

A token acts as you. The line under the access picker says “Acts with your permissions. Write tokens can only change what you can edit.”

Create a token

1. Choose New token. The dialog title is New token.
2. Enter a name. Choose Access and Expiry.
3. Choose Create token.
4. The dialog title changes to Copy your token. It says “You won’t see this token again. Copy it now.” Choose Copy, then Done.

Access is Read, Write, or Admin. The dialog starts on Read. Admin is offered only when you are an admin. Expiry is 30 days, 90 days, 365 days, or No expiry. The dialog starts on 90 days.

The columns are Name, Access, Created, Last used, and Expires. The prefix, such as crimple_ and more characters, is a muted second line under the name. Last used and Expires say “Never” until there is a date. An empty workspace says “No API tokens yet.”

Revoke

Open Token actions and choose Revoke, then Revoke again. The question is “Revoke this token?” and “Anything using it will stop working straight away.” The row stays, with a Revoked badge. Create shows “Token created”. Copy shows “Copied”.

What a token cannot do

Only a signed-in session can create a token, create a service account, change a service account’s teams, or change notification settings. A token that tries is refused. Those routes, and the AI settings routes, have no MCP tool, because a token call cannot succeed. Contract autofill routes also have no MCP tool.

Removing a member and revoking an invite are not MCP tools. The pending-invite list is not an MCP tool. Deactivating a member, reactivating a member, granting or removing admin, and creating an invite stay tools.

MCP is available on the API for the same token and the same permissions as the rest of the product. A local desktop client can also use the stdio entry. A service-account token is described on Service accounts.