Create a token for an agent

Give each agent or environment its own named token. You can then limit its operations or revoke it without affecting other callers.

Generate a token

fused-cli mcp token generate support-agent triage-bot \
  --allow issueUpdate \
  --allow chatPostMessage

curl --request POST \
  --url "$FUSED_ENGINE_URL/workspace/app-tokens?app_family_id=$MCP_ID" \
  --header "X-API-Key: $FUSED_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "triage-bot",
    "allow": ["issueUpdate", "chatPostMessage"]
  }'

For HTTP, use the MCP ID returned by mcp plan, mcp apply, or mcp list as MCP_ID. The token field in the response is the execution token. Anything absent from allow is denied. Omit the scope to grant every operation exposed by the MCP server.

The plaintext token is returned once. Store it when you generate it; token listings never return the token or its hash.

Bind the token to a connected user

A fixed binding pins the token to a service, auth scheme, and connected-user reference. Add a resource UUID when the provider connection exposes selectable resources.

fused-cli mcp token generate support-agent triage-bot \
  --allow issueUpdate \
  --fixed-binding 'jira,OAuth2,user_123'

curl --request POST \
  --url "$FUSED_ENGINE_URL/workspace/app-tokens?app_family_id=$MCP_ID" \
  --header "X-API-Key: $FUSED_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "triage-bot",
    "allow": ["issueUpdate"],
    "binding_mode": "fixed",
    "bindings": [
      {
        "service_slug": "jira",
        "auth_name": "OAuth2",
        "end_user_ref": "user_123"
      }
    ]
  }'

Repeat --fixed-binding or add more objects to bindings when the agent uses multiple services. The stored binding remains authoritative if a request supplies a different selector.

List or revoke tokens

fused-cli mcp token list support-agent
fused-cli mcp token revoke support-agent triage-bot

Tokens apply to the whole MCP app family, so they continue to work when you publish a new version. Generating, listing, and revoking tokens requires app.tokens.manage.

Tokens for OAuth services

Choose between fixed and caller-selected connected users.

Get Started

Guides

Advanced

Reference

Create a token for an agent

Generate a token

Bind the token to a connected user

List or revoke tokens

Tokens for OAuth services

​Generate a token

​Bind the token to a connected user

​List or revoke tokens

Tokens for OAuth services

Generate a token

Bind the token to a connected user

List or revoke tokens