API tokens
A bearer credential for clients that can't sign in through a browser. Each token stops working after 30, 90, or 365 days. Most people never need one: Claude Code and other OAuth-capable agents connect without any key to copy.
/mcp → spawnpoint → Authenticate; see Getting started. Use a token only when the client is a script, a CI job, or something else that can't do a browser sign-in.What it is
A token is a bearer credential tied to your account. It looks like spk_live_1a2b3c…. Your client sends it to the MCP server on every call, and spawnpoint uses it to figure out which account the deploy belongs to. The endpoint accepts it in place of an OAuth access token.
When to use one
OAuth is the default because you never paste a secret anywhere: you approve once in the browser, and your agent stores and refreshes the credentials itself. Use a token where OAuth does not work: a shell script, a cron job, a CI pipeline, or an MCP client with no OAuth support.
Create one
- Sign in to your console.
- Open the API tokens panel, choose how long the token works (30 days, 90 days, or 1 year; 90 days unless you change it), and click Create token. If you are on a team, Deploys as picks whether the token deploys your own apps or the team's: a team token deploys to every app on that team.
- Copy the
spk_live_…value immediately: it is shown only once.
Use it
Send it as the bearer token on the MCP endpoint:
Authorization: Bearer spk_live_your_tokenHow we keep it safe
- Hashed at rest. We store only a hash of your token. The full value is shown once, when you create it, and we can't recover it.
- Expires on its own. Every token stops working on the date the console shows, at most a year after you made it, so a token you forgot about does not work forever.
- Revoke anytime. Revoke a token from the console and it stops working instantly.
- Scoped to you or your team. A token can reach only its own account's projects, or its team's when it was made for a team.
Good practice
- Don't commit tokens to a repo or paste them in chats.
- Use a separate token per agent or environment, so you can revoke one without touching the others.
- Replace a token before it expires: create a new one, switch your client to it, then revoke the old one. The console marks tokens that stop working within two weeks, and an expired token gets an error that says it expired.