MCP & Access Tokens

Found in your account menu: click your initials or picture at the top right of any page, then MCP & Access Tokens.

This page is yours, not your affiliate's: publishers, account managers and admins all have it, and nothing on it needs account-admin rights. It has three parts:

1. Connect an AI assistant: add Routy to Claude or ChatGPT as a connector. Nothing to copy.
2. Or use a token: create a token for an assistant you set up with a config file or a command (Claude Desktop, Claude Code, Cursor), and copy a ready-made config.
3. Your tokens: every token you've made, and every app you've connected.

A personal access token lets a tool (an AI assistant, a script, a BI tool) act as you, with only the permissions you choose.

It is separate from Settings → API tokens, which is still there and still the right place for some jobs:

Came here from the old Settings → MCP tab? See If you used the old Settings → MCP tab.

Watch this video on its own page →

What your assistant can and can't do

An assistant connects as you, with the permissions you gave it. The token shortcut ticks every read permission you can grant (the same set as the Read only preset on API tokens) and nothing that writes, deletes or hands out credentials. If your own access shrinks, so does the assistant's.

The assistant can never change anything, whatever the token holds: the Routy MCP server only reads.

Made a token before November 2026? Older tokens from this shortcut hold only reports.read. They keep working, but the assistant can answer only about reports and issues. To let it see your accounts, links and the rest, create a new token and revoke the old one.

Affiliates

Your affiliates are the one you own plus any you've been added to as a collaborator by another affiliate. Whenever this page asks which affiliates a token or an app may work on, it lists all of them:

• Leave it empty and it works on all your affiliates: the ones you have now, and any you're added to later.
• Pick some and it is limited to those.

Either way it never reaches further than you can yourself: if you're removed as a collaborator, the token loses that affiliate too, within about 30 seconds. It works on one affiliate at a time; an assistant picks one per question. If you have only one affiliate, there's nothing to choose.

Connect an AI assistant

The quickest way, for Claude and ChatGPT. The page shows the connector URL:

https://mcp.routy.app/mcp

Copy it with the copy button, or use Open Claude / Open ChatGPT to jump to that app's connector settings in a new tab.

Claude (web, desktop app and mobile)

1. In Claude, open Settings → Connectors and choose Add custom connector.
2. Name it Routy and paste the connector URL. Click Add.
3. Click Connect. Your browser opens Routy's Connect an app page; sign in if you're asked.
4. Check the permissions and affiliates, then click Allow. You're sent back to Claude, connected.

A connector you add on claude.ai is also available in the Claude desktop and mobile apps. On a Claude Team or Enterprise plan, an owner may have to add the connector for the organisation first.

ChatGPT

1. In ChatGPT, open Settings → Connectors. Custom connectors may need Developer mode switched on under Advanced, depending on your plan.
2. Create a connector, name it Routy, paste the connector URL and choose OAuth as the authentication.
3. Your browser opens Routy's Connect an app page. Click Allow.

Claude Code

Run this in a terminal:

claude mcp add --transport http routy https://mcp.routy.app/mcp

Then, in Claude Code, run /mcp, pick routy and choose Authenticate. Your browser opens the Connect an app page; click Allow. To use a token instead, see below.

Menu names in these apps change between versions. If an option isn't where these steps say, look for Connectors, Integrations or MCP in the app's settings.

Every app you connect this way appears under Your tokens as a connected app. See Connect an app for the approval page itself.

Use a token with an assistant

For assistants you set up with a config file or a command, or when you'd rather paste a token than approve in the browser.

1. Under Or use a token, click Create token for MCP. The form opens with a name filled in and every read permission you can grant ticked.
2. Choose the affiliates and the expiry, and change the name if you like. Click Create.
3. Pick your assistant (Claude Desktop, Claude Code, Cursor or Other) and click Copy config (or Copy command).
4. Paste it where your assistant expects it (below), then restart the assistant.

The token is shown once. The configs are built from it, so copy what you need before you close the panel. If you lose it, revoke the token and create a new one.

If the file already lists other MCP servers, add Routy alongside them: the config we give you shows only the Routy entry.

A token that works on several affiliates is fine for an assistant: it asks Routy which affiliates you have and picks one per question.

What a token can and can't do

• Never more than you. A token can only use permissions you hold yourself. If your own access is reduced, every token you made shrinks with it.
• Only what you ticked. A token carries exactly the permissions you chose when you created or last edited it. It never gains a permission on its own — not even one you're given later.
• One affiliate at a time. A token works on the affiliates you chose (or all of yours). A tool picks which one on each request.
• Unused tokens switch themselves off after 90 days without use (7 days for a token with System admin). A switched-off token cannot be turned back on — create a new one.

Create a token

1. Click New token above Your tokens.
2. Give it a name — at least 4 characters, unique among your tokens. Name it after the tool and the job ("Claude — reporting"); that's how you'll recognise it later.
3. Pick when it expires: a date, or No expiration. A token with no expiration still switches itself off after 90 days unused.
4. Choose the affiliates it works on. Leave the box empty and it works on all your affiliates, including ones you get access to later. Pick some and it is limited to those.
5. Tick the permissions it needs. They're grouped (Accounts, Reports, …); Select all ticks every permission in the list — never the admin ones below it. Pick the fewest that do the job.
6. Click Create.
7. Copy the token now. Use Copy or Download .txt.

The token is shown once. After you close that panel it can't be shown again — not by us, not by support. If you lose it, revoke the token and create a new one.

You can have up to 20 active tokens at a time. Expired, switched-off and revoked tokens don't count.

Admin permissions

If you hold them, System admin and Account manager appear in their own section below the checklist. They grant full administrative access, including every admin screen — use them only for tools you fully trust. Select all never ticks them.

A token with System admin:

• must have an expiry date, at most 30 days ahead — No expiration isn't offered;
• works on every affiliate, so it can't be limited to selected affiliates (the affiliate box is disabled while System admin is ticked, and System admin is unavailable while affiliates are selected);
• switches itself off after 7 days unused.

The list

"N new permissions available"

This appears on a token when you hold permissions the token doesn't carry — usually because new permissions were added to the platform, or you were given more access. Tokens never pick these up automatically; that's deliberate. Click the badge to open the token with the new permissions marked New, tick the ones you want, and save.

Edit a token

Click Edit on an active token. You can change its name and its permissions:

• Removing a permission: untick and save.
• Adding a permission: tick and save. Only permissions you hold are offered.

The secret doesn't change, so the tool keeps working without being reconfigured.

The expiry and the affiliates can't be changed — to change them, create a new token. For the same reason, System admin can't be added to a token that is limited to some affiliates, or that has no expiry or one more than 30 days away.

Expired, switched-off and revoked tokens can't be edited.

Revoke a token

Click the revoke icon on the row (or Revoke on the card on a phone) and confirm. The token stops working within 30 seconds — tokens that were just checked are briefly remembered. If you're revoking because a token leaked, treat that half-minute as real.

Revoked tokens stay in the list, greyed, so you can see what happened to them. You can reuse a revoked token's name.

Connected apps

A connected app is Claude or ChatGPT that you connected to Routy from the app itself, by adding Routy as a connector and clicking Allow on the "Connect an app" page. You don't copy a token for it; the app receives its access directly.

Each connection is a row in this list:

• its name is the app and the day you connected it, such as Claude (connected 2026-10-24) (a second connection on the same day gets #2 after it);
• Created shows the app's name instead of Manual;
• it carries the permissions and affiliates you chose when you allowed it;
• it has no last four characters and no expiry date.

It counts towards your 20 active tokens, like any other.

To disconnect an app, revoke its row. It stops working within about 30 seconds. To connect it again later, start from the app; you'll get a new row.

You can edit a connection's name and permissions like any token, but you can never add an admin permission to it.

If you used the old Settings → MCP tab

Before this page existed, an account admin connected an assistant from a tab called MCP in Settings. That tab is gone. Assistants now connect from this page, and anyone on the team can do it, not only an account admin.

Settings → API tokens is not going away. Only the MCP tab was removed. API tokens stay where your account keeps its keys for long-running backend services.

Nothing you set up there has stopped working. Each connection the old tab made was an API key for your affiliate that could only read reports. Routy still accepts those keys, so an assistant you configured with one keeps answering.

Where to find them now. They're listed in Settings → API tokens, among your account's other keys, named after the assistant and the day it was connected (for example Claude Code — 2026-02-19), with Reports · Read as their only permission. Only an account admin can open that tab.

How an old key differs from a connection made here:

Should you move over? It depends on what uses the key:

• An assistant a person uses (Claude Code on someone's laptop, say): yes. A connection made here puts it under that person's name and access, and it ends with them. Steps below.
• A backend service that was pointed at the key: keep it as an API token. That's what API tokens are for. You may want a replacement with the permissions the service actually needs.

To move an assistant over:

1. Connect the assistant again from this page, with the connector or with a token.
2. Ask it a question to check it works.
3. In Settings → API tokens, delete the old key. Last Used tells you whether something is still using it. It stops working within about 30 seconds.

Set up Claude Desktop from the old tab and it never connected? The config the old tab gave for Claude Desktop was a form Claude Desktop doesn't start. Delete that key and set Claude Desktop up again from Use a token with an assistant, or add Routy as a connector in Claude instead, which needs no config file at all.

The old tab's Connected / Not yet connected labels are gone with it. In Settings → API tokens, Last Used answers the same question.

Using a token (for whoever sets up the tool)

Send it as a header on every request:

Authorization: Bearer rpat_…

Authorization: ApiKey rpat_… works too.

A token that works on more than one affiliate must say which one each request is for, with the x-affiliate-id header. Leave it out and the request is refused with a 400 whose info.affiliateIds lists the affiliates the token can use — a quick way for a tool to discover them.

A token can't create, edit or revoke tokens, or change your password or profile. That needs you, signed in. Neither kind of token works on the older API at addresses without /v1/, and an API token from Settings → API tokens is sent differently (ApiKey, never Bearer). See Which token works where.

Common questions

The page says access tokens aren't available yet. The feature hasn't been switched on for your account. Nothing is wrong with your access.

A tool gets 401 with a token that shows Active. Check the address: a personal access token works only on /v1/ addresses and on the assistant connector. If the tool was given a key from Settings → API tokens instead, it must send it as ApiKey, not Bearer. See Which token works where.

A tool that worked yesterday now gets 401. Check the token's Status. Expired and Disabled — unused tokens can't be revived — create a new one and give the tool the new secret.

A tool gets 403 on something it used to do. The token doesn't carry that permission, or you no longer hold it yourself. Edit the token to add it, if it's offered; if it isn't offered, you don't hold it.

I can't find the MCP tab in Settings. It moved here. Keys it made are under Settings → API tokens; see If you used the old Settings → MCP tab.

I can't tick System admin. Either the token is limited to selected affiliates, or (when editing) its expiry is missing or more than 30 days away. Create a new token instead.