Create API tokens that an agent can safely use

1. 1

   Open API tokens

   Go to Dashboard → Account → Settings → API tokens.
2. 2

   Name the token

   Use a name that explains who or what will use it, such as ‘Claude Code on marketing site’ or ‘weekly reporting script’.
3. 3

   Choose the minimum scopes

   Give an agent only the reads or writes it needs. For example, analytics reporting needs analytics:read, while an event-setup workflow also needs events:write.
4. 4

   Copy it once

   The plaintext token is shown once at creation. Store it in the client’s secure environment configuration, never in source code.

Scopes include project read/write, analytics read, revenue read, funnel read/write, event write, alert write, and Search Console read. The MCP checks scopes and tells you which one is missing instead of silently guessing.

Revoke a token when a teammate leaves, an integration is retired, a laptop or repository is exposed, or you no longer want an agent to have access. Create a new scoped token rather than reusing a token in a different context.