# API keys

Tokens let a tool act as you, within limits you set when you create them.

## Where they live

Account settings → **Developer**. Every token is listed with its name, when it was created, and when it was last used.

The “last used” column is the useful one. A token that has not been used in months is a token to revoke.

## Creating one

Tokens are issued by signing in from the tool, not by generating a string and pasting it:

```
workover login              # read + propose
workover login --publish    # ...and publish to WordPress
```

The browser shows what is being granted before you approve. The raw token is written to `~/.workover/config.json` on that machine and is never shown again — Workover stores only a hash of it, so a leak of our database cannot be replayed against your account.

## Scopes

**read** — search and read your documents. Always granted.

**propose** — create documents and propose revisions, arriving as tracked suggestions for a person to accept. Always granted.

**publish** — write to your connected WordPress sites. Only if you asked for it at sign-in.

Scopes are fixed when the token is minted. Widening one means signing in again and approving the new grant; there is no way for a tool to escalate its own token.

## What no token can do

Account security, billing, and token management are unreachable at every scope. Those need a browser session.

A publishing token also **cannot override a sync conflict** — if WordPress changed since the last sync, the push is refused rather than forced. That guard is the one thing standing between an automated push and silently destroying an edit nobody has seen.

## Revoking

Revoke from **Developer**, or run `workover logout` on the machine holding it. Immediate either way.

Revoke when: a laptop is lost, someone leaves, a tool is retired, or you see a “last used” you cannot explain.

## Good practice

- **One token per machine or tool**, so revoking one does not disturb the rest.
- **Grant publish only where you need it.** A token on a CI runner rarely needs to publish.
- **Review the list occasionally.** It takes a minute and it is the only place a forgotten integration shows up.

## Related

- [The CLI and MCP server](/docs/cli-and-mcp)
- [Two-factor authentication](/docs/two-factor-authentication)
- [Your profile](/docs/your-profile)