The admin page where the bearer tokens that authenticate the external
content API are listed, created and revoked. It is a global page at
/api-tokens, in the sidebar’s directory group next to Workspaces and
Members — not a workspace-scoped one.
Install
npm install @apograph/api-tokens-adminRegister
// apps/admin/src/plugins.ts
import { ApiTokensPlugin } from '@apograph/api-tokens-admin';
ApiTokensPlugin();No configuration and no environment variables.
Where the halves live
This package and the identity endpoints behind it are the token lifecycle. The API those tokens are spent against belongs to the content plugin, and — when it is enabled — to MCP, which accepts the same tokens with the same scopes.
That split is worth holding on to when reasoning about blast radius: revoking a token here closes every surface at once, because there is only one credential.
A secret is shown once
Creating a token reveals its secret in a dialog and stores only its hash. Nothing in the list or detail reads can show it again. If it is lost, revoke the token and mint another.
Scope before you issue
A token carries the workspaces and the permissions it may use. A full-scope token handed to an agent through the MCP endpoint can do everything its scope allows, which is the intended behaviour and also the reason to issue a narrow one.
See API tokens for presenting a token to the public API, and permissions for the keys a scope is built from.