[ Docs ](https://sendnda.com/docs)     

 [ Agents and the API ](https://sendnda.com/docs/agents)     

API tokens
==========

Create a token in your settings for a client that does not speak OAuth.

 05

Agents and the API
------------------

Article 3 of 3

 Most MCP clients sign in with OAuth. Some don't, and a script of your own might not either. For those, create an API token in your settings and send it as a bearer token. It opens the same MCP server with the same four tools.

Create a token
--------------

1. Sign in and open **Settings**.
2. Under **Agent access**, give the token a name you'll recognise later, like *Claude Desktop*, and press **Create token**.
3. Copy the token right away. It's shown once, and we can't show it again: we only keep a hash of it.

A token lasts one year from the day you create it. It carries one ability, `mcp:use`, which opens the MCP server and nothing else.

Use a token
-----------

Point your client at the MCP address and send the token in the `Authorization` header:

```
POST https://sendnda.com/mcp
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json
```

The server speaks MCP over streamable HTTP, so the body is an MCP message, not a plain REST call. Most clients let you add a header to a remote server in their configuration. The limit is the same as over OAuth: 120 requests per minute per account.

Keep it safe
------------

A token acts as you. Whoever holds it can send an NDA in your name, and `create-nda` emails both parties straight away. So:

- keep a token out of code you share and out of repositories;
- give each client its own token, so you can cut one off without the others;
- revoke a token you no longer use.

You're responsible for what's done with your tokens, including by agents you connect. The [Acceptable Use Policy](https://sendnda.com/legal/acceptable-use) sets out the rules.

Revoke a token
--------------

Your settings list every token with when it was created and when it was last used. Press the bin icon next to one and confirm. It stops working immediately, and any agent using it loses access.

Deleting your account removes all your tokens with it. For clients that do speak OAuth, [Connect over MCP](https://sendnda.com/docs/agents/connect-over-mcp) is the simpler route: no token to copy, and nothing to store.

 Checked against the code on 21 September 2026.

 [   The four tools ](https://sendnda.com/docs/agents/the-four-tools)