MCP tokens are org-scoped bearer secrets. Create them in Settings, copy once, and revoke any time — hashes are stored, plaintext never is.
Quick answer
Go to Settings → MCP tokens → Issue. Name it, pick a role override (optional), copy the lwm_... token immediately, and paste it into your AI client. Revoke from the same page any time.
What to know
Token format: lwm_<base32> — starts with lwm_
Shown once at creation, then only the SHA-256 hash is stored
Org-scoped (not user-scoped) — team members inherit access
Only owners and admins can set a role override lower than their own
Where to find it in Lemwatch
Settings → MCP tokens.
How to rotate a token
Issue a new token with the same name.
Update your AI client's config with the new value.
Revoke the old token from the tokens list.
Confirm the old token returns 401 within a minute.
FAQ
I lost my token — can I retrieve it?
No. Revoke and issue a new one.
Who can see token names?
Any team member with viewer+ role. Only owners/admins can create or revoke.