Tokens
How personal access tokens work — creating, scoping, expiry, and revoking them.
A token is how your editor proves it's you to the OrbitOrca MCP server. You create tokens on the dashboard's Connect an agent page, under Access tokens.
A token acts as you. Anything it can read, the agent in your editor can read too — and a write token can change your apps and billing. Treat a token like a password: don't paste it into shared files or chats.
Creating a token
When you create a token you choose two things:
- Access — Read (the default) or Read & write. Read lets the agent look; write lets it make changes. See Scopes & safety.
- Expiry — a fixed number of days, or Never. A shorter life is safer; pick the shortest that fits how you work.
The full token is shown once, at creation. Copy it straight into your editor's config — if you lose it, you can't see it again, so you create a new one and revoke the old.
Managing tokens
The Access tokens table lists every token by name, scopes, when it was created, when it was last used, and when it expires. From there you can:
- Revoke a token — it stops working immediately. Do this the moment a token might be exposed, or when you stop using an editor.
- Delete a revoked token to clear it from the list. A token must be revoked before it can be deleted.
- Revoke all or Delete revoked in bulk, when you want to reset every connection at once.
Revoking one token never affects the others — each editor you connect can have its own.
OAuth connectors
Some hosts — Claude.ai and Claude Desktop — connect over OAuth instead of a pasted token: you approve OrbitOrca on a consent screen and the host holds the connection as an app. These show up in your token list as an app, and you revoke them the same way. See Claude.ai / Claude Desktop.