API key (Personal Access Token)

1. In the admin panel, open your workspace's Access Tokens page (Settings → Access Tokens).
2. Click New and give the token a name that identifies where it's used (e.g. "Claude Code on my laptop").
3. Under Use this grant with, check MCP. If you also want the same token usable against the REST API, check API too.
4. Under Permissions, grant exactly what the agent needs: a mix of workspace-wide abilities and/or specific libraries with specific abilities. See Permissions & abilities for what each option means. Grant the minimum the agent actually needs; you can always come back and adjust it later.
5. Optionally set an expiry date.
6. Save. The token's plaintext value is shown once, immediately after creation. Copy it now. TKP never stores or displays it again; if you lose it, revoke the token and create a new one.

Using it

Send the token as a bearer token on every request to /mcp:

POST {APP_URL}/mcp HTTP/1.1
Authorization: Bearer <your-token>
Content-Type: application/json

Most MCP clients that support "remote server with a custom header" just need the URL and this header; see Example clients for specifics.

Revoking access

Delete the token from the Access Tokens list at any time; it stops working immediately. Tokens also stop working once their expiry date passes, if you set one.