Skip to content

Manage personal access tokens

You will learn how to create, scope, rotate, and revoke PATs for REST and MCP.

Personal access tokens (lxp_…) authenticate you to the REST API and MCP server. They are not stream ingest keys — use Manage stream API keys for shipping logs.

Create a token

  1. Open Settings → API tokens.
  2. Click New token.
  3. Enter a name (for example cursor-laptop).
  4. Choose Full access (same surface as your account) or pick least-privilege scopes such as stream read, query, views, keys, monitors, or MCP ingest.
  5. Optionally restrict the token to selected streams and set an expiry.
  6. Confirm create.
  7. Copy the secret from Save this API token — shown only once.

Use the token

Send it as a Bearer token:

Authorization: Bearer lxp_<prefix>_<secret>

Typical uses:

  • Cursor / Claude MCP: Connect MCP
  • Scripts calling the REST API
  • Agent sample ingest via MCP ingest_events (requires events:ingest; not for production shippers)

Rotate a token

  1. On API tokens, find an active token.
  2. Click Rotate.
  3. Confirm the overlap window (default 5 minutes). Both the old and new secrets work during overlap; afterward only the successor works.
  4. Copy the new secret once and update your MCP or script config.

Rotation keeps the same scopes and stream allowlist and records lineage so you can see which token replaced which.

Revoke a token

  1. On API tokens, find the token.
  2. Click Revoke and confirm.

Clients using that secret lose access immediately (including any remaining rotation grace window).

Next