API & Integrations

How do I create and revoke MCP tokens?

MCP tokens are org-scoped bearer secrets. Create them in Settings, copy once, and revoke any time — hashes are stored, plaintext never is.

Updated 2026-07-10

1 min read

mcp

tokens

security

Quick answer#

Go to Settings → MCP tokens → Issue. Name it, pick a role override (optional), copy the lwm_... token immediately, and paste it into your AI client. Revoke from the same page any time.

What to know#

Token format: lwm_<base32> — starts with lwm_

Shown once at creation, then only the SHA-256 hash is stored

Org-scoped (not user-scoped) — team members inherit access

Only owners and admins can set a role override lower than their own

Where to find it in Lemwatch#

Settings → MCP tokens.

How to rotate a token#

Issue a new token with the same name.

Update your AI client's config with the new value.

Revoke the old token from the tokens list.

Confirm the old token returns 401 within a minute.

FAQ#

I lost my token — can I retrieve it?#

No. Revoke and issue a new one.

Who can see token names?#

Any team member with viewer+ role. Only owners/admins can create or revoke.

MCP server overview

MCP security and scopes

MCP rate limits by tier

Was this article helpful?

What is the Lemwatch MCP server?

MCP tool catalog: everything Claude and ChatGPT can call

What is the Lemwatch MCP server?

Lemwatch runs a hosted Model Context Protocol server so AI assistants like Claude and ChatGPT can read your sites and act on incidents.

MCP security model and role scopes

MCP tokens inherit the calling member's role, further clamped by an optional role override. Writes require confirm. Admin actions require admin.

MCP rate limits and tier gating

Each plan gets a different MCP request-per-minute budget and tool allow-list. Free/LTD-1 read-only and 1 site; Agency gets everything.

Google Search Console & GA4 Integration

Connect Google Search Console and GA4 to see search performance and traffic data inside LemWatch.

Back to Help Center