---
title: "How do I create and revoke MCP tokens? — Lemwatch Help"
description: "MCP tokens are org-scoped bearer secrets. Create them in Settings, copy once, and revoke any time — hashes are stored, plaintext never is."
canonical: "https://lemwatch.com/help/mcp-tokens-manage"
source: "https://lemwatch.com"
---

# How do I create and revoke MCP tokens?

> MCP tokens are org-scoped bearer secrets. Create them in Settings, copy once, and revoke any time — hashes are stored, plaintext never is.

## Quick answer

 Go to Settings → MCP tokens → Issue. Name it, pick a role override (optional), copy the lwm_... token immediately, and paste it into your AI client. Revoke from the same page any time.

## What to know

- Token format: lwm_<base32> — starts with lwm_

- Shown once at creation, then only the SHA-256 hash is stored

- Org-scoped (not user-scoped) — team members inherit access

- Only owners and admins can set a role override lower than their own

## Where to find it in Lemwatch

 **Settings → MCP tokens.**

## How to rotate a token

- Issue a new token with the same name.

- Update your AI client's config with the new value.

- Revoke the old token from the tokens list.

- Confirm the old token returns 401 within a minute.

## FAQ

### I lost my token — can I retrieve it?

 No. Revoke and issue a new one.

### Who can see token names?

 Any team member with viewer+ role. Only owners/admins can create or revoke.

## Related

- MCP server overview

- MCP security and scopes

- MCP rate limits by tier


## Related

- [Help centre](https://lemwatch.com/help)
- [What is the Lemwatch MCP server?](https://lemwatch.com/help/mcp-server-overview)
- [MCP security model and role scopes](https://lemwatch.com/help/mcp-security-scopes)
- [MCP rate limits and tier gating](https://lemwatch.com/help/mcp-rate-limits-tiers)
- [MCP tool catalog: everything Claude and ChatGPT can call](https://lemwatch.com/help/mcp-tool-catalog)
- [Lemwatch pricing](https://lemwatch.com/pricing)