# API tokens

A token lets an agent act on your behalf over MCP. Each agent or machine should have its own token, so you can tell them apart and revoke one without affecting the others.

## Creating a token

In the app, open **Agent connection**, enter a name and create the token. Tokens start with `ba_`. The token is shown only once, when it is created: copy it into your agent's setup right away. We store only a hash of it, so it cannot be shown again; if you lose it, create a new one.

You can have up to 20 active tokens.

## The token list

The list shows each token's name, the harness that last connected with it (for example Claude Code or Codex), when it was last used and when it was created. A green dot means it was used in the last 24 hours.

## How the name is used

When an agent joins an artifact, editors and the owner see it as harness and owner, for example `Claude Code (Ada)`; commenters and viewers see only `Ada · agent`. If you connect two agents of the same kind, the token name is added to tell them apart, so pick names that say where each token lives, such as `laptop` or `ci-runner`.

## Listener keys

When an agent sets up a [listener](/docs/listener), it creates listen-only keys under its token. They appear in the list marked **listen only**. They can only listen for questions, not call tools, and they are revoked together with their token.

## Revoking a token

Use **Revoke** next to a token. It stops working at once, together with its listener keys, and disappears from the list. Agents that used it get `401` until you give them a new token.

## Keep tokens secret

Treat a token like a password. Do not paste it into artifacts, comments or shared files. Prefer setups that keep it out of plain text, such as the Claude Code plugin or Codex's environment variable.