Access tokens for CI and scripts

An access token lets CI, a headless machine or a script act as you in one workspace, without your password. You choose what it may do (look, build, or also publish), how long it lasts, and you can switch it off at any moment. Tokens start with apx_pat_.

Do you need one?

Usually not. Claude Code, Cursor, other MCP clients and appbricx login sign in with the browser: they open Appbricx, you click Authorize, and they keep their own short-lived tokens. See Build with your coding agent. Use an access token when:

• The agent or the CLI runs in CI, where no browser can open.
• You work on a remote or headless machine.
• You are calling the developer HTTP API from a script.

Why it matters: a token can't reach billing, admin or workspace settings, and it can't publish unless you give it the deploy scope. If one leaks, the damage is limited and you can revoke it straight away.

Create a token

1. Open Workspace settings → Coding agents in the workspace your agent should build in.
2. Name the token, pick its scopes and, optionally, an expiry.
3. Copy the token. It is shown once. Appbricx stores only a hash and can't show it again.
4. Use the copy-paste config on the same screen ("Connect with a token") for Claude Code, Cursor or the CLI.

With the CLI: appbricx login --token apx_pat_…, or set APPBRICX_API and APPBRICX_TOKEN and skip login. See Developer CLI.

Scopes

The default is read + apply: the agent can build and verify in dev but not publish. Add deploy only when you want the agent to ship. A call without the scope answers 403 FORBIDDEN_SCOPE.

Workspace binding

• A token belongs to one user and one workspace. It reaches only that workspace's projects; any other project answers "Project not found".
• It acts with your role. Writes need a non-viewer role in the workspace.
• A workspace viewer can only mint read tokens.
• If you are removed from the workspace, your tokens for it stop working at once.

Expiry

Set an expiry between 1 and 366 days, or none. An expired token answers 401 UNAUTHENTICATED("Token expired"). Create a new one and update your agent's environment.

Where tokens work

• The MCP server (/api/mcp) and the developer API (/api/dev/v1), which the CLI uses.
• Nowhere else. A token can't reach billing, admin or workspace settings, so a leaked agent token can't change them.
• A token can't mint another token. Minting needs a signed-in session, so a token can never widen itself.

Tokens from browser sign-in

When an agent signs in with the browser, Appbricx gives it an access token that works the same way (same scopes, same workspace binding) but lasts one hour, plus a refresh token that lasts 90 days and changes every time it is used. Those agents are listed under Authorized agents on the same settings screen, not under your tokens. Revoking one ends both its tokens at once. If a refresh token is ever used twice, Appbricx assumes it was stolen and revokes that authorization.

Revoke a token

Revoke it in Workspace settings → Coding agents. It stops working on the next request. From a script:

# list your tokens (id, name, prefix, scopes, expiry, last used)
curl -sS https://appbricx.com/api/dev/v1/tokens \
  -H "Authorization: Bearer $APPBRICX_TOKEN"

# revoke one
curl -sS -X DELETE https://appbricx.com/api/dev/v1/tokens/<token-id> \
  -H "Authorization: Bearer $APPBRICX_TOKEN"

The list shows each token's first characters (its prefix) and when it was last used, so you can tell which one to revoke.

Keep tokens safe

• Store the token in an environment variable (APPBRICX_TOKEN) or a secret manager. In CI, use the CI's secret store.
• Never commit a token. The MCP configs in the repo and the output of appbricx mcp-config reference APPBRICX_TOKEN instead of containing it, so .mcp.json can be committed safely.
• If you pasted a token into claude mcp add --header …, it is saved in your local Claude Code config. Don't share that file.
• Use one token per agent or machine, give it the smallest scopes it needs, and set an expiry.
• Revoke a token as soon as you think it leaked.

Next

• Build with your coding agent
• MCP server reference
• Developer HTTP API