Docs / MCP
Authentication
4 minute read · Updated 2026-09-11
One bearer token per workspace, minted in Settings and shown once. It is the tenant boundary: it identifies the workspace, grants the full tool surface, and is checked against your plan on every request.
Minting a token
- 01
Open Settings → MCP access
You must be on a Pro or Studio plan; the mint call is refused otherwise.
- 02
Generate token
The plaintext token is returned exactly once and never shown again. Copy it immediately.
- 03
Store it as a secret
Environment variable or keychain. Never in a repository, a shared doc, or a prompt you paste publicly.
Only the last four characters are visible afterwards, so you can confirm which token a workspace is holding without exposing it.
What a token can do
A token authenticates as a workspace, not as a user, and it is not scoped down further. Anyone holding it can read the whole library and spend the workspace’s credits. There are no read-only tokens today.
| Can | Cannot |
|---|---|
| Read every artist, song, and asset in the workspace | Reach any other workspace |
| Generate images and launch renders (spending credits) | Change billing or cancel the subscription |
| Create and edit strategy, content, and artstyle records | Publish anything anywhere — Studio has no posting integrations |
Rotating and revoking
Regenerating mints a new token and invalidates the old one immediately — there is no grace period, so update your clients in the same sitting. Revoking removes API access entirely until you mint again.
Rotate whenever a token may have been exposed: a commit, a screen share, a pasted config, a laptop you no longer control.
Authentication failures
| Response | Meaning |
|---|---|
| 401 — Missing bearer token | No Authorization header reached the server. Check your client is actually sending the header. |
| 401 — Invalid MCP token | The token does not resolve. It was revoked, replaced by a newer mint, or copied incompletely. |
| 401 — MCP/API access requires the Pro plan or higher | The token is valid but the workspace is no longer entitled. Upgrade, or expect this on every call. |
Keep going