Skip to main content
Free - minting and using API tokens is not plan-gated.
An account API token (fpat_…) is the Bearer credential that authorizes requests to the MCP server at POST /mcp. It is scoped to your account, so any tool call made with it acts as you, against your own forms and submissions only.
Today, an API token authorizes the MCP server only. There is no general REST API it unlocks - Formpaste does not have a public REST “Forms API” or “Provisioning API.” If that changes in the future, it will reuse this same token mechanism rather than introduce a second credential type.

​
Minting a token

  1. Open the dashboard → Settings → API & MCP.
  2. Click New token and give it a name (e.g. laptop or claude-code) so you can tell tokens apart later.
  3. The raw token is shown exactly once, immediately after creation. Copy it now, because Formpaste never stores or displays the raw value again.
Paste it straight into your MCP client config - see MCP server → Install for the exact block.

​
How it’s stored

Formpaste stores only a SHA-256 hash of your token, never the raw value. This is the same reason the raw token isn’t recoverable after the creation screen closes - if you lose it, mint a new one and revoke the old one.

​
Revoking a token

From Settings → API & MCP, click Revoke next to any token. Revocation is immediate: the next /mcp request using that token gets
Revoke a token if it leaks (e.g. pasted somewhere public) or if you’re decommissioning a machine/agent that had it. There’s no way to “pause” a token - revoking is permanent; mint a new one to reconnect.

​
Scope

When you mint a token you choose its scope: A setup token is the safe default for handing to an autonomous coding agent that only needs to create and wire forms: it can do the whole setup and verify loop but can never read a visitor’s submitted content. A setup token calling list_submissions gets a forbidden error. Existing tokens are full by default. A token is always owner-scoped - it can only ever act on the account it belongs to, regardless of scope.

​
Access key vs. API token

These are two different credentials with different security postures - don’t confuse them: If you’re wiring a <form> to accept visitor submissions, you want the access_key. If you’re connecting an agent to manage forms via MCP, you want the API token.

MCP server

Where this token gets used.

Your first form

Where a form’s access_key comes from instead.