Personal Access Tokens (PAT) guide
Generate secure, scoped Personal Access Tokens to authenticate custom API scripts, automated ingestion pipelines, and Model Context Protocol (MCP) servers.
Available token scopes
When creating a Personal Access Token, apply the principle of least privilege by selecting only necessary scopes:
| Scope key | Capability granted |
|---|---|
read:clients | List client workspaces, company names, industry, and settings. |
read:metrics | Retrieve multi-channel performance metrics (Meta, Google, TikTok, LinkedIn, etc.) and report summaries. |
read:mentions | Access Social Listening feeds, sentiment breakdown, and Brand Watch metrics. |
read:trends | Retrieve client breakout queries, rising audio, and viral market signals. |
read:crm | Read CRM deal pipeline stages, won values, and lead conversion records. |
read:contentlab | Query generated video scripts, hook formulas, and Content Lab ideas. |
How to generate a personal access token
Step 1: Open API & MCP settings
- In the sidebar, navigate to Settings → API & MCP Access.
- Click the + New Token button.
Step 2: Configure token parameters
- Token name: Enter a descriptive name (e.g., "Claude Code CLI" or "Agency Automation").
- Workspace restrictions: Choose between All Client Workspaces or restrict the token to specific client accounts.
- Select scopes: Check the specific permissions required.
- Expiration: Select token lifespan (30 Days, 90 Days, or 365 Days).
Step 3: Copy and save securely
- Click Create Token.
- Copy the generated secret key (
mcl_pat_xxxxxxxxxxxxxxxxxxxxxxxx). - Store the token in your password manager.
WARNING
For security reasons, the full token secret is only displayed once upon creation and cannot be retrieved later.
Token management and revocation
In the Active Tokens list:
- Last used timestamp: Monitor when the token was last utilized by an external agent.
- Revoke: Immediately invalidate any active token. Once revoked, external API or MCP sessions using that token will immediately fail authentication.