Docs / Integrations / API tokens

API tokens

An API token lets another program act on your boards as you. Kevta uses them for one thing today: authenticating the MCP server, so an AI client such as Claude Code or Claude Desktop can read and change your tasks.

What a token is#

A token is a single secret string beginning with kvt_. Whichever program holds it can call Kevta's MCP endpoint on your behalf, and every call it makes is checked against your permissions at that moment — a token never widens what you can already reach.

i
Tokens authenticate the MCP endpoint only. Signing in to Kevta in a browser uses your session instead, so you never need a token to use the app itself.

Every token carries a name, a fixed expiry, and an optional board scope. There are no non-expiring tokens — the longest life you can choose is 90 days.

User-wide tokens#

A user-wide token reaches every workspace and board you have access to. It is the right choice for your own machine.

  1. Open Profile and find the API tokens (MCP) card.
  2. Give it a name you will recognise later — the placeholder suggests Claude Code laptop. Names can be up to 80 characters.
  3. Choose an expiry: 7 days, 30 days or 90 days.
  4. Press Create token.

Board-scoped tokens#

A board-scoped token can only ever touch the one board it was created from. Use it for automation that has no business seeing the rest of your work.

  1. Open the board, then Settings → API tokens.
  2. Name it, choose an expiry, and press Create token.

The scope is enforced on the server, not in the client: a scoped token handed a different board's ID is refused, and listing boards returns only the board it is tied to.

Copy it once#

Kevta shows the token exactly once, on the screen where you created it, with a Copy token button. It is never displayed again and cannot be recovered — Kevta does not keep a copy it could show you.

!
Paste it somewhere safe before you dismiss the panel. If you lose a token, revoke it and create a replacement — there is no way to reveal an existing one.

Review & revoke#

Both surfaces list your active tokens. Each row shows what you need to decide whether a token is still pulling its weight:

Each token row shows
NameThe label you gave it at creation.
ScopeAll access for a user-wide token, or Board: name for a scoped one.
PrefixThe first few characters, so you can tell two tokens apart without revealing either.
DatesWhen it was created and when it expires.
Last usedThe last time it authenticated a request, or never used — the quickest way to spot a token you can retire.

Revoke on a row kills that token immediately. The next request carrying it is rejected; nothing else you own is affected. Revoking is the correct response to a token you have leaked, lost, or simply stopped using.

How they are stored#

  • Only a hash is kept. Kevta stores a one-way SHA-256 hash of the token and compares hashes on lookup. The plaintext exists only in the response that created it.
  • Unguessable. Each token carries 256 bits of randomness.
  • Fails closed. A token that is unknown, expired, or revoked is rejected outright — there is no partial or degraded access.
  • Permissions are re-checked every time. Lose access to a board and every token of yours loses it too, with no reissue needed.
✓
Ready to connect a client? The MCP server guide has the exact configuration for Claude Code and Claude Desktop.
Kevta is in beta