Skip to main content
The Agents page (top navigation) is where programmatic access to your account is managed: API tokens for the Agent API and connections from AI agents using the MCP server.

​
API tokens

Tokens look like sgpt_... and are sent as a bearer header:

​
Create a token

1

Open Agents and create a token

Select Create token and name it after what will use it, for example “CI knowledge sync”.
2

Choose an access level

  • Standard: the common read/write permissions most automations need.
  • Full: everything the API can do, including deletes.
  • Custom: pick permissions per area (profile, chatbots, knowledge, conversations, leads, and so on) with separate read, write, and delete grants.
3

Scope it to chatbots

A token can cover all chatbots or only specific ones. Scope third-party or single-purpose tokens to the one chatbot they need.
4

Copy it once

The token value is shown once at creation and stored hashed. If you lose it, rotate it.

​
Manage tokens

The Agents page lists every token with its scopes. Rotate issues a new value while keeping the scopes; Revoke kills it immediately. Rotate tokens when a team member leaves or a token may have leaked.

​
MCP connections

AI agents connect to SiteGPT through the MCP server using OAuth: the agent requests access, you approve it in the browser, and the connection appears on the Agents page. Each connection shows what it can access and can be revoked there at any time. Setup instructions for Claude, Cursor, and other MCP clients are in the MCP server guide.

​
Device login for the CLI

sitegpt login uses an OAuth device flow: the CLI shows a code, you confirm it in the browser, and the CLI receives a token with standard scopes. Those sessions are visible and revocable like any other token. See CLI authentication.
The legacy v0 API uses a separate account-level API key, not sgpt_ tokens. New integrations should use the v2 Agent API; the v0 reference documents the legacy key for existing integrations.