API tokens
A long-lived bearer credential for clients that can't sign in through a browser. Most people never need one: Claude Code and other OAuth-capable agents connect without any key to copy.
/mcp → spawnpoint → Authenticate; see Getting started. Reach for a token only when the client is a script, a CI job, or something else that can't do a browser sign-in.What it is
A token is a bearer credential tied to your account. It looks like spk_live_1a2b3c…. Your client sends it to the MCP server on every call, and spawnpoint uses it to figure out which account the deploy belongs to. The endpoint accepts it interchangeably with an OAuth access token.
When to use one
OAuth is the default because nothing sensitive is ever pasted around: you approve once in the browser and your agent stores and refreshes the credentials itself. A static token is the escape hatch for the cases OAuth can't cover: a shell script, a cron job, a CI pipeline, or an MCP client with no OAuth support.
Create one
- Sign in to your console.
- Open the API tokens panel and click Create token.
- Copy the
spk_live_…value immediately: it's shown once and never again.
Use it
Send it as the bearer token on the MCP endpoint:
Authorization: Bearer spk_live_your_tokenHow we keep it safe
- Hashed at rest. We store only a hash of your token, the raw value is shown once at creation and we can't recover it.
- Revoke anytime. Revoke a token from the console and it stops working instantly.
- Scoped to you. A token only ever touches its own account's projects.
Good practice
- Don't commit tokens to a repo or paste them in chats.
- Use a separate token per agent or environment, so you can revoke one without touching the others.
- Rotate periodically, create a new one, swap it in, revoke the old.