> ## Documentation Index
> Fetch the complete documentation index at: https://usefused.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a token for an agent

> Issue a scoped MCP token and optionally bind it to connected users.

Give each agent or environment its own named token. You can then limit its operations or revoke it without affecting other callers.

## Generate a token

<CodeGroup>
  ```bash CLI theme={null}
  fused-cli mcp token generate support-agent triage-bot \
    --allow issueUpdate \
    --allow chatPostMessage
  ```

  ```bash HTTP theme={null}
  curl --request POST \
    --url "$FUSED_ENGINE_URL/workspace/app-tokens?app_family_id=$MCP_ID" \
    --header "X-API-Key: $FUSED_API_KEY" \
    --header "Content-Type: application/json" \
    --data '{
      "name": "triage-bot",
      "allow": ["issueUpdate", "chatPostMessage"]
    }'
  ```
</CodeGroup>

For HTTP, use the MCP ID returned by `mcp plan`, `mcp apply`, or `mcp list` as `MCP_ID`. The `token` field in the response is the execution token.

Anything absent from `allow` is denied. Omit the scope to grant every operation exposed by the MCP server.

<Warning>
  The plaintext token is returned once. Store it when you generate it; token listings never return the token or its hash.
</Warning>

## Bind the token to a connected user

A fixed binding pins the token to a service, auth scheme, and connected-user reference. Add a resource UUID when the provider connection exposes selectable resources.

<CodeGroup>
  ```bash CLI theme={null}
  fused-cli mcp token generate support-agent triage-bot \
    --allow issueUpdate \
    --fixed-binding 'jira,OAuth2,user_123'
  ```

  ```bash HTTP theme={null}
  curl --request POST \
    --url "$FUSED_ENGINE_URL/workspace/app-tokens?app_family_id=$MCP_ID" \
    --header "X-API-Key: $FUSED_API_KEY" \
    --header "Content-Type: application/json" \
    --data '{
      "name": "triage-bot",
      "allow": ["issueUpdate"],
      "binding_mode": "fixed",
      "bindings": [
        {
          "service_slug": "jira",
          "auth_name": "OAuth2",
          "end_user_ref": "user_123"
        }
      ]
    }'
  ```
</CodeGroup>

Repeat `--fixed-binding` or add more objects to `bindings` when the agent uses multiple services. The stored binding remains authoritative if a request supplies a different selector.

## List or revoke tokens

```bash theme={null}
fused-cli mcp token list support-agent
fused-cli mcp token revoke support-agent triage-bot
```

Tokens apply to the whole MCP app family, so they continue to work when you publish a new version. Generating, listing, and revoking tokens requires `app.tokens.manage`.

<Card title="Tokens for OAuth services" icon="user-check" href="/docs/mcp/oauth-tokens">
  Choose between fixed and caller-selected connected users.
</Card>