Skip to main content
The Agents page (top navigation) is where programmatic access to your account is managed: API tokens for the Agent API and connections from AI agents using the MCP server.

​
API tokens

Tokens look like sgpt_... and are sent as a bearer header:

​
Create a token

1

Open Agents and create a token

Select Create token and name it after what will use it, for example “CI knowledge sync”.
2

Choose an access level

  • Standard: the common read/write permissions most automations need.
  • Full: everything the API can do, including deletes.
  • Custom: pick permissions per area (profile, chatbots, knowledge, conversations, leads, and so on) with separate read, write, and delete grants.
3

Scope it to chatbots

A token can cover all chatbots or only specific ones. Scope third-party or single-purpose tokens to the one chatbot they need.
4

Copy it once

The token value is shown once at creation and stored hashed. If you lose it, rotate it.

​
Manage tokens

The Agents page lists every token with its scopes. Rotate issues a new value while keeping the scopes; Revoke kills it immediately. Rotate tokens when a team member leaves or a token may have leaked.

​
MCP connections

AI agents connect to SiteGPT through the MCP server using OAuth: the agent requests access, you approve it in the browser, and the connection appears on the Agents page. Before authorizing, a client can complete the MCP initialize handshake, list all 17 tools, and read the inline app-view resources without a token — useful for connectivity checks — but every tool call requires the OAuth grant. Each connection shows what it can access and can be revoked there at any time. Setup instructions for Claude, Cursor, and other MCP clients are in the MCP server guide.

​
Local (stdio) hosts

Some MCP hosts only support local servers. Use the local entry point:
  1. Run sitegpt login to authorize the CLI on your account (or set SITEGPT_API_TOKEN).
  2. Point the host at npx -y @sitegpt/mcp as a local (stdio) MCP server. It delegates to sitegpt mcp from @sitegpt/cli — one implementation, two entry points.
The local server exposes the same tools as https://sitegpt.ai/mcp.

​
Device login for the CLI

sitegpt login uses an OAuth device flow: the CLI shows a code, you confirm it in the browser, and the CLI receives a token with standard scopes. Those sessions are visible and revocable like any other token. See CLI authentication.
The legacy v0 API uses a separate account-level API key, not sgpt_ tokens. New integrations should use the v2 Agent API; the v0 reference documents the legacy key for existing integrations.