Skip to main content

Access (API Tokens and OAuth)

Open Workspace Settings, then Access.

This is how the SparkLogs AI plugin and any MCP client (including Copilot Studio) authenticate to a workspace. It is not how SparkLogs Agents enroll (those use registration tokens).

The plugin and most MCP hosts use OAuth. You do not need an API token to connect your AI.

Connected apps (including MCP integrations and the plugin) can request scopes on a dedicated consent screen. After you approve, the app appears in the workspace Access list. Disconnect it there if a host should no longer query the workspace.

Workspace API tokens​

Mint a token only when the host cannot do OAuth (for example a headless job that only accepts a static secret).

  • Mint a token with the scopes the client needs.
  • When you mint a new token, grantable MCP scopes are selected by default; narrow them if this client should see less.
  • If you ever need it: Revoke stops that token immediately. You cannot undo revoke from this screen. Mint a replacement if you still need access.

Treat the secret like a password. The UI shows it at create time; store it in your host's secret mechanism, not in a shared ticket.

How to use a token in an Authentication header and how to modify our plugin's MCP server definition to use a bearer token depend upon your specific AI harness.

Scope and isolation​

Queries run as the authenticated workspace (and the org scope that grant or token allows). They do not cross into other customers' workspaces.

Next: Connect your AI.