Skip to main content

🔑 Access Tokens

An access token, or API token, is a key that lets a tool or AI agent act on the site as you, limited to the scopes you choose. This page will guide you through creating a token, choosing its scopes and expiry, watching how it is used and revoking it.

Owner-only

This page is for the site owner. API tokens are available to site owners only. If you are not an owner, "API & MCP" says so and asks you to ask an owner.

Creating a token​

Open "API & MCP" in the Studio. The page says "Let tools and AI assistants work with the site through API tokens. Each token acts as you, limited to the scopes you choose."

  • Press "Create token" at the top of the page.
  • Give it a "Name", such as the tool that will use it. The placeholder suggests "Claude Desktop".
  • Tick the "Scopes" it needs. See below.
  • Choose when it "Expires": 30 days, 90 days, 1 year or never.
  • Press "Create token". A window headed "Copy your new token" shows it.
  • Copy it now. The token starts with sxa_ and is shown only once. If you lose it, revoke it and create another.

A token looks like sxa_xxxxxxxx. Treat a real one like a password. Do not paste it into chats, documents or screenshots.

Choosing scopes​

Give a token the smallest set of scopes that does the job.

  • Read (read): read stories, topics, choices, tags, writers, Briefs and the rebuild status.
  • Write content (write:content): create and edit stories, topics, choices, ideas, tags, writers, Briefs, navigation and images. It cannot publish or delete.
  • Publish (publish): publish, schedule and unpublish content, and delete it.
  • Settings (settings): site settings and analytics, rebuilds, export and import, contact messages, readers and editors.
  • Manage pages (admin:pages): owners only. List, create, edit, publish, unpublish and delete site pages such as About.

For a drafting agent, read and write:content is usually enough. This ensures an agent cannot put anything live without you. See Safety and permissions.

Connecting a client​

Below the tokens, "Connect an MCP client" shows your site's endpoint and ready-made setup for "Claude Desktop / Cursor (mcpServers)", "Claude Code" and "curl". Replace <your-token> with the token. See Claude Desktop and Cursor and Claude Code.

Watching tokens​

The "Tokens" table lists each token's name, the first characters of the token, its scopes, when it was created and expires, when it was last used and its status ("Active", "Expired" or "Revoked").

The "Recent activity" table lists changes made with tokens, newest first, kept for 90 days. Reads are not logged.

Revoking a token​

Press "Revoke" on an active token and confirm. Tools using the token lose access straight away, and this cannot be undone.

warning

A token stops working if the owner who created it stops being an owner, and it works again if they are made an owner again, unless it was revoked.

Best Practices​

  • One tool, one token: name it after the tool, so the audit log shows who did what.
  • Prefer an expiry: 30 or 90 days is a good default for an agent you are trying out.
  • Revoke when in doubt: creating a new token takes a minute.