Access tokens
Every time you sign in with workover login and approve the request, Workover creates an access token for that machine. The Workover CLI and MCP server use it to act as you. Workover lists these tokens as Connected devices. There are no API keys to generate: the only way to get a token is to sign in from the terminal, as described in Set up your agent.
Tokens do not expire, so review the list from time to time and revoke any you no longer use.
Review your connected devices
- Click your avatar in the top-right corner and choose Profile.
- In Account settings, open the Developer tab.
- Under Connected devices, each row shows the token’s name, when it was added, and when it was last used, or “not used yet”.
The name is the one given at sign-in with --client, or “Workover CLI” if none was given.
Revoke a token
Revoke a token when you stop using a tool, lose a machine, or see a device you do not recognize.
Warning: Revoking takes effect immediately and there is no confirmation step. Any tool using that token stops working until someone signs in again on that machine.
- From the browser: on the token’s row under Connected devices, click Revoke.
- From the machine that holds it: run
workover logout. This revokes the token and deletes~/.workover/config.json, the file that stores it. If the CLI cannot reach Workover at that moment, it still signs out but the token stays active, so check Connected devices afterward.
Signing in again does not revoke the old token
Running workover login again, for example to add a scope, stores a new token on the machine and a new row appears under Connected devices. The previous token stays active until you revoke it, so revoke the old row once the new sign-in works.
What a token can reach
A token holds only the scopes approved when it was created, and those never change. Every token can read your documents and suggest changes; anything more needs a flag at sign-in. No token, whatever its scopes, can change your account security, your billing or your tokens. Workover stores only a hash of each token, never the token itself.
For each scope and what it unlocks, and for using a token with the HTTP API, see CLI commands and MCP tools.
Related
Still need help?
Can’t find what you’re looking for? Our team is here to help.