# Tokens

Source: /docs/mcp/tokens-and-oauth

A token is how your editor proves it's you to the OrbitOrca MCP server. You create tokens on the dashboard's [Connect an agent](https://app.orbitorca.com/mcp) page, under **Access tokens**.

> A token acts as you. Anything it can read, the agent in your editor can read too — and a write token can change your apps and billing. Treat a token like a password: don't paste it into shared files or chats.

## Creating a token [#creating-a-token]

When you create a token you choose two things:

* **Access** — **Read** (the default) or **Read & write**. Read lets the agent look; write lets it make changes. See [Scopes & safety](/docs/mcp/scopes-and-safety).
* **Expiry** — a fixed number of days, or **Never**. A shorter life is safer; pick the shortest that fits how you work.

The full token is shown **once**, at creation. Copy it straight into your editor's config — if you lose it, you can't see it again, so you create a new one and revoke the old.

## Managing tokens [#managing-tokens]

The **Access tokens** table lists every token by name, scopes, when it was created, when it was last used, and when it expires. From there you can:

* **Revoke** a token — it stops working immediately. Do this the moment a token might be exposed, or when you stop using an editor.
* **Delete** a revoked token to clear it from the list. A token must be revoked before it can be deleted.
* **Revoke all** or **Delete revoked** in bulk, when you want to reset every connection at once.

Revoking one token never affects the others — each editor you connect can have its own.

## OAuth connectors [#oauth-connectors]

Some hosts — Claude.ai and Claude Desktop — connect over **OAuth** instead of a pasted token: you approve OrbitOrca on a consent screen and the host holds the connection as an app. These show up in your token list as an **app**, and you revoke them the same way. See [Claude.ai / Claude Desktop](/docs/mcp/connect/claude-ai).