Skip to main content

Access (API Tokens and OAuth)

Open Workspace Settings, then Access.

This is how the SparkLogs AI plugin and any MCP client authenticate to a workspace. It is not how SparkLogs Agents enroll (those use registration tokens).

Workspace API tokens​

  • Mint a token with the scopes the client needs.
  • When you mint a new token, grantable MCP scopes are selected by default; narrow them if this client should see less.
  • Rename for humans ("Cursor on the service desk laptop").
  • Revoke stops that token immediately. You cannot undo revoke from this screen. Mint a replacement if you still need access.

Treat the secret like a password. The UI shows it at create time; store it in your host's secret mechanism, not in a shared ticket.

Connected apps (including MCP integrations and the plugin) can request scopes on a dedicated consent screen. After you approve, the app appears in the Access list. Disconnect it there if a host should no longer query the workspace.

Use OAuth when the host supports it so you are not pasting a long-lived token into a config file. Use a token when the host only supports static secrets.

Scope and isolation​

Queries run as the authenticated workspace (and the org scope that token or grant allows). They do not cross into other customers' workspaces.

Next: Connect your AI.