Create and revoke API tokens
You'll create an API token for your own tools, see what its abilities let it do, and revoke tokens you no longer use.
Create an API token when your application needs to read or change your RightMessage projects without a browser session. The same token works with the REST API, the dashboard's media routes, and the hosted MCP server.
Sign in with the account whose projects the application should access. The token belongs to your user account, so it reaches every project you can open, not just the one you have open now. Creating a token needs a plan that includes API access on the project you have open. If it doesn't, API tokens explains which plan unlocks it, and any tokens you already have stay listed so you can still revoke them. You'll also need secure server-side storage for the token.
Working with an AI assistant instead? The RightMessage MCP card at the top of API & AI access has Copy project instructions: paste them into your agent and approve access in your browser. You won't need to copy a token. Its Setup guide button opens rightmessage.com/mcp, and Connect RightMessage to your AI assistant covers the details.
Create a token in the app
- Open Your account (the avatar at the bottom of the sidebar), then API & AI access.
- Under API tokens, enter a Token name, such as
WorkForge reporting. - Choose Create token.
- If RightMessage asks you to Confirm your password, enter your account password and choose Confirm. It asks when you haven't entered your password recently, then creates the token as soon as you've confirmed.
- Copy the new token and save it in your application's secret storage.
RightMessage shows the complete token once, with Copy it now. We won't show it again. After that, the list shows each token's name and when it was last used. Never used means no use has been recorded. A wrong password shows The provided password was incorrect. under the field, and Cancel closes the prompt without creating anything.
Tokens created here have full access (*): they can read, change, and publish. The page has no ability selector. Keep tokens out of browser JavaScript, public repositories, screenshots, and shared AI conversations.
Only you, signed in to the dashboard, can create or revoke tokens. A token can't create another token or revoke one, even a full-access token, so a leaked token can't be used to make a new one or to lock out your other tools. It gets 403 with API tokens can't use this endpoint. Sign in to the dashboard to do this.
What a token's abilities allow
Every token carries a list of abilities. Listing your tokens with GET /v1/tokens shows each one's abilities.
| Ability | What the token can do |
|---|---|
read | Read project data and settings. It can't change or publish anything. |
write | Everything read can, plus changes: creating, editing, and deleting configuration, starting exports, uploading media, and other account changes. It can't publish. |
publish | Publish the project's draft and take a page offline. On its own it can't read or change anything else, so pair it with read or write when the application also needs those. |
* | Everything above. Tokens created on the API & AI access page have *. |
POST /v1/tokens accepts an abilities array, but only from a signed-in dashboard session, so you can't create a narrower token with another token. There's no way to edit a token's abilities either. To change what an application can do, create a replacement and revoke the old token.
Where abilities apply
A token is held to its abilities everywhere it works, and signed-in dashboard sessions and AI assistants connected through OAuth aren't limited by them.
- REST API (
/v1/{teamPid}): read routes acceptreadorwrite, changes needwrite, andPOST /{teamPid}/publishneedspublish. Each operation in the OpenAPI reference lists the abilities it accepts inx-rightmessage-abilities. - Dashboard API (
/api, such as the media library routes): judged by the request method. GET requests needreadorwrite, and every other method needswrite, even one that only reads. A few GET requests that change something needwritetoo: opening the billing portal, subscribing or changing plan, and starting or finishing an integration's sign-in. Publishing needspublish, and subscribing and publishing in one step needs bothwriteandpublish. So do the Ads page actions that put ad audiences live at once (choosing an ad's segments, accepting a suggested segment, and accepting new ads in review), and changing the ad account of, or disconnecting, Meta Ads, which changes the ad audiences on your live site. Restoring a published version copies it into the draft, so that's awrite. - Hosted MCP server: your assistant only sees the tools the token can use. See which MCP tools a token sees.
Abilities limit what a token can do, not which projects it reaches. Project membership, plan features, and suspension checks still apply on top of them.
When a token lacks an ability
The request is refused with 403 and nothing changes.
| Where | What comes back |
|---|---|
REST project routes (/v1/{teamPid}) | {"message":"Invalid ability provided."} |
Dashboard API and /v1/oauth-connections | A message naming the missing ability, such as This API token can't make changes: it needs the `write` ability. Create a token with it under Your account › API & AI access. |
| MCP tools | A tool error with the same message. |
| Creating or revoking a token | API tokens can't use this endpoint. Sign in to the dashboard to do this. |
Revoke a token
Revoking a token immediately stops applications that use it from authenticating.
- Open Your account > API & AI access.
- Under API tokens, find the token by its name.
- Choose Revoke on that row.
- In the confirmation that names the token, choose Revoke token.
The token disappears from the list. Choose Cancel if you're not ready to interrupt the application.
If a token is exposed, revoke it rather than renaming the application. Create a replacement only for the applications that still need access.
Make authenticated requests
Use the REST API authentication and request conventions for request headers, project IDs, and error handling. AI assistant connections are disconnected separately under AI assistants on the same page. See MCP authorization.