# Tokens and permissions

> How GetIntel MCP access works for an OAuth connection and for a page token, read versus action access, how each is tied to a brand, and how to revoke and rotate them safely.

Source: https://getintel.ai/docs/mcp/tokens-and-permissions/

An agent reaches your data one of two ways: a **connection** made by signing in, or a **token** you create on the Agent page. Both decide which brand the agent sees and whether it may take actions.

## OAuth connections

Signing in from a client (Claude, ChatGPT, Cursor, VS Code, Claude Code) creates a connection, made at the approval page you see after sign-in:

- **Brand:** picked automatically if your account has one, chosen by you if it has several. One connection sees one brand.
- **Actions:** off unless you tick **Also allow actions**.
- **Access tokens:** last 2 hours and refresh automatically behind the scenes, on the same brand, for as long as the connection lasts.

**Revoking:** disconnect the connector in the client (Claude's or ChatGPT's Connectors settings, Cursor's or VS Code's MCP settings). There's nothing to delete in GetIntel; a connection isn't a token on the agent card.

To change the brand or the actions permission, disconnect and connect again and choose differently at approval.

## Page tokens

Created by hand on GetIntel's **Agent** page (or **Integrations**, then the agent card), for a client without sign-in support or for a script.

<Aside>
A page token is bound to the brand you had selected when you created it, and it **never expires** — it stays valid until you revoke it. Switching brand in GetIntel doesn't change what an existing token sees.
</Aside>

### Creating a token

Open the **Agent** page, choose whether the agent may take actions, then generate the token. **Copy it straight away: it is shown once.**

### Read versus action access

| | Read-only token | Token with action access |
| --- | --- | --- |
| Read tools (28) | ✓ | ✓ |
| `update_task`, `plan_week`, `recheck_technical` | Hidden | ✓ |

A read-only token doesn't even list the action tools, so an agent can't try to call them. If it does, the server replies that the action needs the `act` permission.

<Aside type="tip">
Start read-only. Create a token with action access only for the agent you want managing your task list.
</Aside>

### One token, one brand

Agencies create one token per client brand.

### Revoking and rotating

- **Revoke:** delete the token from the agent card. Any agent using it stops working immediately.
- **Rotate:** create a new token, update your agent's config, then revoke the old one.

## Keeping access safe

- Treat a token like a password. Anyone holding it can read that brand's data.
- Don't commit tokens to version control; keep config files with tokens out of your repository.
- Use a separate token, or a separate connection, per person or agent, so you can revoke one without breaking the others.