Skip to content

Manage personal access tokens

You will learn how to create, scope, rotate, and revoke PATs for REST and MCP.

Personal access tokens (lxp_…) authenticate you to the REST API and MCP server. They are not stream ingest keys — use Manage stream API keys for shipping logs.

Create a token

  1. Open Settings → API tokens.
  2. Click New token.
  3. Enter a name (for example cursor-laptop).
  4. Choose Full access (same surface as your account) or pick least-privilege scopes such as stream read, query, views, keys, monitors, or MCP ingest.
  5. Optionally restrict the token to selected streams and set an expiry.
  6. Confirm create.
  7. Copy the secret from Save this API token — shown only once.

Least-privilege scopes

  • streams:read — list streams and inspect stream metadata.
  • events:read — query, sample, export, resolve views, and list/get saved view definitions.
  • ops:read — read REST /v1/ops/* as an already-authorized platform operator. This is platform-wide: a stream allowlist does not narrow operator results, and the scope does not make a normal user an operator.
  • views:write — create, preview, update, and delete saved views; read or change saved table layouts; and change sidebar order.
  • streams:write — create and manage streams (including anomaly detection settings), and resolve learned-field type conflicts (stream role checks still apply).
  • keys:write — create and revoke stream ingest keys.
  • events:ingest — write sample events through MCP ingest_events.
  • monitors:write — manage metrics, monitors, alerts, and notification channels; dismiss, reopen, and mute findings; and watch patterns.
  • materialization:retry — retry event materialization.

Choose Full access for *, which includes every current scope. Existing legacy full-access tokens continue to work on operator reads when their owner also has the platform-operator grant.

When a token has selected streams, Cordo filters stream and saved-view inventories before page limits, cursors, sidebar order, or name ambiguity are calculated. An empty stream selection means unrestricted within your current memberships; it does not grant access to streams your account cannot use.

Use the token

Send it as a Bearer token:

Authorization: Bearer lxp_<prefix>_<secret>

Typical uses:

  • Cursor / Claude MCP: Connect MCP
  • Scripts calling the REST API
  • Agent sample ingest via MCP ingest_events (requires events:ingest; not for production shippers)

Rotate a token

  1. On API tokens, find an active token.
  2. Click Rotate.
  3. Confirm the overlap window (default 5 minutes). Both the old and new secrets work during overlap; afterward only the successor works.
  4. Copy the new secret once and update your MCP or script config.

Rotation keeps the same scopes and stream allowlist and records lineage so you can see which token replaced which.

Revoke a token

  1. On API tokens, find the token.
  2. Click Revoke and confirm.

Clients using that secret lose access immediately (including any remaining rotation grace window).

Next