Personal access tokens and revoking access

Documentation / Agentic editing and connections

A personal access token, or PAT, lets a local MCP server or integration authenticate as your Beeboo account. Anyone holding it can make the requests its scopes and your current website permissions allow. Treat it as a secret, not a shareable connection address.

Understand the controls

Open Settings > Advanced > Agent Access Tokens. The creation form contains Token label, Allow changes, and Expires. The available expiry choices are 30 days, 90 days, 180 days, and one year. Clearing Allow changes requests read-only access; selecting it requests both read and write.

If you choose Create token, the full credential is displayed once. It cannot be revealed again from the list. Store it privately using your organization's approved method. A descriptive label helps identify its purpose without embedding a person's contact details or a secret.

A PAT is account-scoped rather than pinned to the page you happened to have open. Each API request still selects a website and undergoes a site-access check. Keep its permissions no broader than the integration needs.

Revoke the right access

Use Revoke on a PAT you no longer recognize, no longer need, or believe was exposed. Confirm the warning: revocation cannot be undone. Remove the old credential from the local client as well. If a replacement is needed, configure it privately rather than pasting it into a conversation.

OAuth connectors appear separately under Connected apps. Disconnect revokes that connection, not unrelated PATs. Conversely, revoking a PAT does not disconnect an OAuth app.

For authentication failures, check expiry, revocation, scopes, and website membership before changing configuration. Share only redacted errors with support. See agentic editing and connections for choosing between PAT and OAuth.