> ## Documentation Index
> Fetch the complete documentation index at: https://sitegpt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API tokens & MCP

> Create scoped API tokens and manage AI agent connections from the Agents page.

The **Agents** page (top navigation) is where programmatic access to your
account is managed: API tokens for the
[Agent API](/docs/api-reference/v2/getting-started) and connections from AI
agents using the [MCP server](/docs/cli/mcp-server).

## API tokens

Tokens look like `sgpt_...` and are sent as a bearer header:

```bash theme={null}
curl -H "Authorization: Bearer sgpt_your_token" https://sitegpt.ai/api/v2/me
```

### Create a token

<Steps>
  <Step title="Open Agents and create a token">
    Select **Create token** and name it after what will use it, for example
    "CI knowledge sync".
  </Step>

  <Step title="Choose an access level">
    * **Standard**: the common read/write permissions most automations need.
    * **Full**: everything the API can do, including deletes.
    * **Custom**: pick permissions per area (profile, chatbots, knowledge,
      conversations, leads, and so on) with separate read, write, and delete
      grants.
  </Step>

  <Step title="Scope it to chatbots">
    A token can cover **all chatbots** or only specific ones. Scope
    third-party or single-purpose tokens to the one chatbot they need.
  </Step>

  <Step title="Copy it once">
    The token value is shown once at creation and stored hashed. If you lose
    it, rotate it.
  </Step>
</Steps>

### Manage tokens

The Agents page lists every token with its scopes. **Rotate** issues a new
value while keeping the scopes; **Revoke** kills it immediately. Rotate
tokens when a team member leaves or a token may have leaked.

## MCP connections

AI agents connect to SiteGPT through the MCP server using OAuth: the agent
requests access, you approve it in the browser, and the connection appears
on the Agents page. Each connection shows what it can access and can be
revoked there at any time.

Setup instructions for Claude, Cursor, and other MCP clients are in the
[MCP server guide](/docs/cli/mcp-server).

## Device login for the CLI

`sitegpt login` uses an OAuth device flow: the CLI shows a code, you confirm
it in the browser, and the CLI receives a token with standard scopes. Those
sessions are visible and revocable like any other token. See
[CLI authentication](/docs/cli/authentication).

<Note>
  The legacy v0 API uses a separate account-level API key, not `sgpt_` tokens.
  New integrations should use the v2 Agent API; the
  [v0 reference](/docs/api-reference/getting-started) documents the legacy key for
  existing integrations.
</Note>