Tokens & permissions

Create and revoke named tokens in API & agent connections.

The full token is shown once and cannot be retrieved again. If you lose it, create a replacement. Keep it in a secret manager or your MCP client’s secret environment, never in a URL, chat or committed file.

HTTP requests use:

Authorization: Bearer <personal token>

Use a personal integration token, not an app login token, cookie or session share code.

Permissions

Scope	Allows
data:read	Default. Read sessions, permitted event data and saved analysis.
sessions:write	Create sessions and import tracks/wind into sessions you own.
compute:write	Recalculate finished sessions you own.
flo:write	Use your FLO credits for session conversations.

Write permissions are opt-in. Check /me for features available to your connection. Existing tokens do not automatically gain new permissions.

Expiration

Upcoming web release

Expiration controls require the token-expiry backend release. Until then, the token page offers revocation only.

New tokens will offer 30 days, 90 days (default), 1 year or 2 years. Existing tokens will receive 90 days from the rollout; check their displayed expiry date. The account limit is ten active tokens.

Replace a token

Create a replacement, update your tool and verify /me works, then revoke the old token. Revocation blocks future authorization; it does not cancel work already dispatched or its usage charges.

You can still revoke connections after your subscription ends.