Skip to content
LogoLogo

API tokens

Personal access tokens let scripts and external tools call the Discontinue API as you. Create and manage them under Account → API tokens. A token authenticates like your login does: it carries your identity and your current role in a workspace, checked live on every request. It never grants more than you can do yourself, and several things less (see below).

Send it as a bearer header:

Authorization: Bearer dpat_...

Creating a token

  1. Open Account → API tokens and choose a name.
  2. Pick a scope: Read-only (GET requests only) or Read & write.
  3. Pick a binding: one workspace, or all my workspaces.
  4. Optionally set an expiry (1 to 365 days).

The full secret is shown exactly once, right after creation. We store only a hash; if you lose the secret, revoke the token and create a new one. The list shows a short prefix, the scope, the binding, and when each token was last used.

Workspace binding

  • A workspace-bound token works in that one workspace only. It cannot see or reach your other workspaces, even though you can.
  • An all-workspaces token can act in any workspace you are a member of, but must name one on every request with the X-Workspace-Id header. If the header is missing or names a workspace you cannot access, the API returns an error listing the workspace ids the token can use.

What a token can never do

Regardless of scope, a token cannot:

  • Manage your account (password, two-factor, deletion)
  • Create or delete workspaces
  • Create or revoke API tokens
  • Access billing (subscription, wallet, invoices)
  • Access admin surfaces

Tokens follow your access

A token's rights are your rights at the moment of the request, not at the moment of creation:

  • If your role in a workspace changes (see Team & roles), the token's rights change with it immediately.
  • If you are removed from a workspace, tokens bound to it stop working immediately; an all-workspaces token loses that workspace.
  • If your account is deleted, all your tokens are deleted with it.

Requests made with a token count against the same plan quotas and spend limits as work done in the app (see Limits & cost controls).

Revoking

Revoke a token any time from Account → API tokens. Revocation is immediate and permanent. Treat a token like a password: if it may have leaked, revoke it first and ask questions later.

Connect an AI assistant (MCP)

An assistant that speaks MCP, such as Claude, Claude Code, Cursor, VS Code or Codex, can work in your workspaces through https://discontinue.dev/api/v1/mcp/manage. Add that URL to the assistant and sign in when it asks: Discontinue shows which app is asking, and you allow it. In Claude Code, for example:

claude mcp add --transport http discontinue https://discontinue.dev/api/v1/mcp/manage

Then open /mcp in Claude Code and sign in. The server URL and setup steps for Claude, Codex, Cursor and VS Code are under Account → AI assistants in the app.

A connected app acts as you, in all your workspaces, with your role in each, so it can create and change agents and reports for you. What it builds starts as a draft: an agent becomes a version you or the assistant activate, and a report is saved only after it renders against your live data. A new agent gets its own chat in the app, so you can continue the work there. Connecting an app and giving consent always happen in the app.

Connected apps

Apps you have allowed are listed under Account → AI assistants, with when each was connected and last used. You are not asked to sign in again: an app stays connected until you choose Disconnect, which ends its access at once. Changing or resetting your password disconnects every app, as it revokes every token.

With a token instead

Scripts, and assistants that cannot sign in, can send a token as their bearer header:

claude mcp add --transport http discontinue https://discontinue.dev/api/v1/mcp/manage \
  --header "Authorization: Bearer dpat_..."

With a Read & write token the assistant can do what a connected app does, in the workspaces the token's binding allows.

API reference for agents

Start at /api/v1/api-docs/llms.txt: an index of areas, one list per area, and a Markdown page per operation with its parameters, request body and a curl example. The same filtered operations are available as an OpenAPI document at /api/v1/api-docs/openapi.json. Both require a token (or a signed-in browser session) and an authorized workspace. All-workspaces tokens and browser sessions must select it with X-Workspace-Id; workspace-bound tokens already select their workspace.

The reference reflects your current workspace role and token scope. Members do not see admin-only operations, and read-only tokens do not see write operations. Account deletion, workspace deletion, token management and platform administration remain excluded even for admins. Hidden operation pages return 404. The reference is generated from the API, but seeing an operation does not bypass its resource permissions or approval requirements.