# Access tokens

Every time you sign in with `workover login` and approve the request, Workover creates an access token for that machine. The Workover CLI and MCP server use it to act as you. Workover lists these tokens as **Connected devices**. There are no API keys to generate: the only way to get a token is to sign in from the terminal, as described in [Set up your agent](/docs/cli-and-mcp/).

Tokens do not expire, so review the list from time to time and revoke any you no longer use.

## Review your connected devices

1. Click your avatar in the top-right corner and choose **Profile**.
2. In **Account settings**, open the **Developer** tab.
3. Under **Connected devices**, each row shows the token’s name, when it was added, and when it was last used, or “not used yet”.

The name is the one given at sign-in with `--client`, or “Workover CLI” if none was given.

## Revoke a token

Revoke a token when you stop using a tool, lose a machine, or see a device you do not recognize.

> **Warning:** Revoking takes effect immediately and there is no confirmation step. Any tool using that token stops working until someone signs in again on that machine.

- **From the browser:** on the token’s row under **Connected devices**, click **Revoke**.
- **From the machine that holds it:** run `workover logout`. This revokes the token and deletes `~/.workover/config.json`, the file that stores it. If the CLI cannot reach Workover at that moment, it still signs out but the token stays active, so check **Connected devices** afterward.

## Signing in again does not revoke the old token

Running `workover login` again, for example to add a scope, stores a new token on the machine and a new row appears under **Connected devices**. The previous token stays active until you revoke it, so revoke the old row once the new sign-in works.

## What a token can reach

A token holds only the scopes approved when it was created, and those never change. Every token can read your documents and suggest changes; anything more needs a flag at sign-in. No token, whatever its scopes, can change your account security, your billing or your tokens. Workover stores only a hash of each token, never the token itself.

For each scope and what it unlocks, and for using a token with the HTTP API, see [CLI commands and MCP tools](/docs/cli-and-mcp-reference/).

## Related

- [Set up your agent](/docs/cli-and-mcp/)
- [CLI commands and MCP tools](/docs/cli-and-mcp-reference/)
- [Two-factor authentication](/docs/two-factor-authentication/)
- [Your profile](/docs/your-profile/)