Tokens and permissions
How GetIntel MCP access works for an OAuth connection and for a page token, read versus action access, how each is tied to a brand, and how to revoke and rotate them safely.
An agent reaches your data one of two ways: a connection made by signing in, or a token you create on the Agent page. Both decide which brand the agent sees and whether it may take actions.
OAuth connections
Section titled “OAuth connections”Signing in from a client (Claude, ChatGPT, Cursor, VS Code, Claude Code) creates a connection, made at the approval page you see after sign-in:
- Brand: picked automatically if your account has one, chosen by you if it has several. One connection sees one brand.
- Actions: off unless you tick Also allow actions.
- Access tokens: last 2 hours and refresh automatically behind the scenes, on the same brand, for as long as the connection lasts.
Revoking: disconnect the connector in the client (Claude’s or ChatGPT’s Connectors settings, Cursor’s or VS Code’s MCP settings). There’s nothing to delete in GetIntel; a connection isn’t a token on the agent card.
To change the brand or the actions permission, disconnect and connect again and choose differently at approval.
Page tokens
Section titled “Page tokens”Created by hand on GetIntel’s Agent page (or Integrations, then the agent card), for a client without sign-in support or for a script.
Creating a token
Section titled “Creating a token”Open the Agent page, choose whether the agent may take actions, then generate the token. Copy it straight away: it is shown once.
Read versus action access
Section titled “Read versus action access”| Read-only token | Token with action access | |
|---|---|---|
| Read tools (28) | ✓ | ✓ |
update_task, plan_week, recheck_technical | Hidden | ✓ |
A read-only token doesn’t even list the action tools, so an agent can’t try to call them. If it does, the server replies that the action needs the act permission.
One token, one brand
Section titled “One token, one brand”Agencies create one token per client brand.
Revoking and rotating
Section titled “Revoking and rotating”- Revoke: delete the token from the agent card. Any agent using it stops working immediately.
- Rotate: create a new token, update your agent’s config, then revoke the old one.
Keeping access safe
Section titled “Keeping access safe”- Treat a token like a password. Anyone holding it can read that brand’s data.
- Don’t commit tokens to version control; keep config files with tokens out of your repository.
- Use a separate token, or a separate connection, per person or agent, so you can revoke one without breaking the others.