MCP tokens and revoking

Every external assistant reaches CORA with an access token. Tokens are workspace-scoped, tool-scoped, revocable, and recorded in the call log. Only workspace owners and admins can manage them, under Settings -> MCP access.

Create a token

Under Create access token:

• Name: say which assistant or team uses it, so the call log stays readable.
• Expires in days: starts at 90. Clear the field for a token that never expires.
• Allowed tools: every tool is selected by default. Leave on only the ones this assistant needs. A token needs at least one.

Choose Create token. The token is shown once, with a copy button. Store it in the assistant's settings straight away; CORA keeps only a fingerprint of it and cannot show it again.

A token's tools and expiry cannot be edited later. To change them, create a new token, move the assistant to it, and revoke the old one.

Inspect use

Access tokens lists every token with its state (Active, Revoked, or Expired), the start of the token, how many tools it allows, when it was last used, and when it expires.

Recent calls shows the latest 30 calls: when each happened, which token made it, the tool or method called, whether it succeeded, and how long it took. Calls made with a token that has since been revoked stay in the log.

Revoke a token

Choose Revoke next to an active token and confirm. Connected clients stop working: the next request with that token is refused. A revoked token cannot be turned back on, so create a new one if the assistant needs access again.

Revoke a token when an assistant is no longer used, when someone who had the token leaves, or if the token may have been shared outside the people who should have it.