API tokens

Create, use, rotate, and revoke the API tokens that let an external MCP client act on your organization.

An API token is a long-lived credential that lets a tool outside AgentLeverage — an MCP client like Claude Code or Cursor — call your organization's tools without you signing in. It's the credential Connecting your agent assumes you already have.

Tokens are managed from Settings → API tokens (/app/<your-org>/settings/api-tokens), and only organization admins can create or manage them.

Creating a token

Go to Settings → API tokens and select Create token.
Give it a name (optional, but useful once you have more than one — e.g. "Claude Code – laptop").
Pick an expiry: No expiry, 30 days, 60 days, or 90 days.
Select Create token.

The token is shown once, immediately after creation, as a string starting with agl_. Copy it right away — closing the dialog is the only way out, and the plaintext value is never shown again anywhere in the app.

If you close the dialog without copying the token, you can't retrieve it later. Revoke it and create a new one.

Using a token

A token authenticates as a bearer token in the Authorization header:

Authorization: Bearer agl_<your-token>

See Connecting your agent for the exact config for Claude Code, Cursor, and Claude Desktop.

A token is a separate principal from any human user — it can call your organization's tools, but it's scoped to that one organization, and jobs it creates are badged with the token's name in Job History so you can tell them apart from jobs you ran yourself.

Token status

Each token in the list shows one of three statuses:

Status	Meaning
Active	Valid and usable right now.
Expired	Past its expiry date — no longer usable, but still listed.
Revoked	Manually revoked — no longer usable, but still listed.

The list also shows when a token was created, when it was last used (or "never used"), and when it expires (or "no expiry").

Rotating a token

There's no in-place "regenerate" — rotate by:

Creating a new token.
Updating your MCP client's config with the new token.
Revoking the old token once the new one is working.

Doing it in that order avoids a gap where neither token works.

Revoking and removing

Revoke — immediately stops the token from authenticating. Any client still using it gets 401 Unauthorized right away. This can't be undone.
Remove — deletes the token's row from the list entirely. If the token is still active, revoke it first; removing an active token doesn't invalidate it any faster than revoking does.

Revoking (or removing) a token doesn't touch jobs it already created — those stay in Job History, still badged with the token's name.