API tokens

Most MCP clients sign in with OAuth. Some don't, and a script of your own might not either. For those, create an API token on the Agents page and send it as a bearer token. It opens the same MCP server with the same nine tools.

Create a token

1. Sign in and open Agents.
2. Under API tokens, give the token a name you'll recognise later, like Claude Desktop, and press Create token.
3. Copy the token right away. It's shown once, and we can't show it again: we only keep a hash of it.

A token lasts one year from the day you create it. It carries one ability, mcp:use, which opens the MCP server and nothing else.

Use a token

Point your client at the MCP address and send the token in the Authorization header:

POST https://sendnda.com/mcp
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json

The server speaks MCP over streamable HTTP, so the body is an MCP message, not a plain REST call. Most clients let you add a header to a remote server in their configuration. The limit is the same as over OAuth: 120 requests per minute per account.

Keep it safe

A token acts as you. Whoever holds it can send an NDA in your name, and create-nda emails both parties straight away. So:

• keep a token out of code you share and out of repositories;
• give each client its own token, so you can cut one off without the others;
• revoke a token you no longer use.

You're responsible for what's done with your tokens, including by agents you connect. The Acceptable Use Policy sets out the rules.

Revoke a token

The Agents page lists every token with when it was created and, once it's been used, when it was last used. Press Revoke next to one and confirm. It stops working immediately, and any agent using it loses access.

Deleting your account removes all your tokens with it. For clients that do speak OAuth, Connect over MCP is the simpler route: no token to copy, and nothing to store.