MCP Tokens
Create tokens that allow AI assistants and MCP-compatible clients to interact with your workspace data.
MCP tokens give AI assistants access to your workspace through the Model Context Protocol (MCP). Each token has specific scopes that control what data the assistant can read and which operations it can perform.
How It Works
Create a token, assign it scopes, and configure your MCP-compatible client (such as Claude) with the token. The client can then query your workspace data within the boundaries you set.
Tokens expire after 365 days and can be rotated or revoked at any time.
Scopes
Each token requires at least one scope:
| Scope | What It Grants |
|---|---|
| Operations | Access to trips, groups, orders, and products — the operational side of your workspace |
| Participants | Access to participant personal data including names, emails, passport numbers, and contact details |
The Participants scope includes personally identifiable information (PII). Only grant it when the AI assistant needs to work with traveler details.
Managing Tokens
Creating a Token
- Go to Settings > MCP Tokens
- Click Create Token
- Enter a name (e.g., "Claude Assistant" or "Booking Agent")
- Select one or both scopes
- Click Create
The token value is displayed once after creation. Copy it immediately — you cannot view it again. The list shows only the token prefix for identification.
Rotating a Token
If you suspect a token has been compromised or simply want to refresh it:
- Click the Rotate action on a token row
- A new token is generated with the same name and scopes
- The old token is revoked immediately
- Copy the new token value — it is shown only once
Update your MCP client configuration with the new token.
Revoking a Token
Click Revoke on a token row to permanently disable it. Revoked tokens cannot be reactivated — create a new one if needed.
Token List
The token list shows:
| Column | Description |
|---|---|
| Name | The name you assigned |
| Token | The token prefix (for identification only) |
| Scopes | Which scopes are granted (Operations, Participants, or both) |
| Status | Active or Revoked |
| Last Used | When the token was last used for an API call |
| Expires | The expiration date (365 days from creation) |