Tokens

An agent signs in with a personal API token, and acts as the token's user.

The token

• Access: Admin API. A Data API token can't reach the Admin API, which the MCP server uses.
• Its user holds the Administrators role. The MCP server refuses tokens of other users.
• Created in My account › Tokens, or by an administrator in Users › API tokens. It's shown once.

Its own user

Quickstart with AI uses your own token: the agent acts as you. For lasting work, give the agent a user of its own, Build agent, with the Administrators role:

• Logs show its actions apart from yours, under its name and the user agent TotalBase MCP.
• You can deactivate it, or revoke its tokens, without touching your account.
• Its sessions and tokens are listed on its own page.

Expiry and rotation

A token expires after 365 days by default, and is flagged expiring 30 days before (Settings › Access › Tokens). Regenerate… gives a new secret while the old one keeps working for a while you choose, so you can update the agent's configuration without interrupting it. Revoke stops it at once.

Each token also has its own MCP rate limit, 120 requests per minute by default.

SQL

Views, functions and triggers can only be written in SQL. For an agent to run SQL:

1. Allow API tokens, in Settings › Features › SQL Console, on. Only an administrator signed in to the admin can change it, never a token.
2. The SQL tool group, in Settings › Data API › MCP, on.

SQL runs as TotalBase's database role, outside permissions and payload checks. Every statement stays in the SQL Console's history and the audit log. Turn it on while the agent builds what needs it, and off afterwards if you prefer.

Next steps

• MCP Server.