Tokens

An agent authenticates to the MCP endpoint with a token. Tokens are created per agent and can be scoped and time-limited.

Create a token

1. Open the agent from the Agents tab and expand its panel.
2. Click Create token and give it a name (for example, claude-desktop or ci-runner).
3. Choose a scope:
   • Full — the agent can use every tool its role permits (read and write).
   • Read-only — the agent can only call read tools. Write tools are not even offered to the client, so a read-only token has no way to mutate a queue.
4. Optionally set an expiry (in days). Leave it empty for a token that never expires.

The token is shown once, at creation time. Copy it immediately, Taskforce.sh only stores a hash, so it cannot show you the value again. Tokens look like:

tfa_a4e7acf28b0725971a8c940b2e0e99c99fab4924851fc5b5

WARNING

Treat a token like a password. Anyone with the token can act as the agent, within its permissions. If a token leaks, revoke it and create a new one.

Read-only vs. full tokens

	Read-only token	Full token
Read tools (list, inspect, metrics)	✅	✅
Write tools (retry, remove, pause, …)	❌ not registered	✅ (within role)
Good for	dashboards, investigation, "look but don't touch"	automation that fixes issues

A read-only token is the safest way to let an agent (or a teammate's AI assistant) explore your queues without any risk of a change.

Expiry

Set an expiry for short-lived access, a debugging session, a CI job, or a time-boxed experiment. An expired token is rejected with an expired error and must be replaced.

Revoke a token

Remove a token from the agent's panel to revoke it immediately. Token creation and revocation are recorded in the audit log (token.created and token.revoked).