Create a Personal Access Token

A Personal Access Token is a secret that lets a client use TKP with selected permissions. The client sends it in an HTTP Authorization header. Choose OAuth instead if your client supports signing in through a browser.

Create the token

1. In the TKP admin panel, select the workspace you want the client to access and open API access → Access Tokens.
2. Create a token and give it a name that identifies its use, such as "Claude Code on my laptop".
3. Under Use this grant with, check MCP. Check API too only if the same token also needs to call TKP's REST API.
4. Under Permissions, select read for a library to start with searching and reading. You can grant access to specific libraries or the whole workspace. See Permissions & abilities before adding upload or update permissions.
5. Optionally set an expiry date, then save.
6. Copy the token. TKP shows its full value only once. If you lose it, revoke the token and create another.

Give it to your client

Follow your client's setup instructions, or run the Python example. Where the client asks for a header, enter:

Authorization: Bearer <your-token>

Replace <your-token> with the copied value. The client must send that header with every request to {APP_URL}/mcp, where {APP_URL} is the TKP application address, for example https://tkp.example.com.

Keep the token out of source control and browser-side application code. For a server application, load it from an environment variable or secret store.

Revoke or replace it

In Access Tokens, open the token's actions menu and choose Revoke to stop its use immediately. It also stops working when its expiry date passes. To replace a token, create a new one, update the client, verify the connection and then revoke the old token.