> ## Documentation Index
> Fetch the complete documentation index at: https://formpaste.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API tokens

> The fpat_ Bearer token that authorizes the MCP server. Minted in Settings, shown once.

<Info>**Free** - minting and using API tokens is not plan-gated.</Info>

An **account API token** (`fpat_…`) is the Bearer credential that authorizes requests
to the [MCP server](/docs/agents/mcp-server) at `POST /mcp`. It is scoped to your account, so
any tool call made with it acts as you, against your own forms and submissions only.

<Warning>
  Today, an API token authorizes the MCP server **only**. There is no general REST API
  it unlocks - Formpaste does not have a public REST "Forms API" or "Provisioning
  API." If that changes in the future, it will reuse this same token mechanism rather
  than introduce a second credential type.
</Warning>

## Minting a token

1. Open the [dashboard](https://app.formpaste.com) → **Settings → API & MCP**.
2. Click **New token** and give it a name (e.g. `laptop` or `claude-code`) so you can
   tell tokens apart later.
3. The raw token is shown **exactly once**, immediately after creation. Copy it now,
   because Formpaste never stores or displays the raw value again.

```
fpat_ScqE8h9wN3vLxK2mPq7RtY5uZaBc
```

Paste it straight into your MCP client config - see
[MCP server → Install](/docs/agents/mcp-server#install-one-command) for the exact block.

## How it's stored

Formpaste stores only a **SHA-256 hash** of your token, never the raw value. This is
the same reason the raw token isn't recoverable after the creation screen closes - if
you lose it, mint a new one and revoke the old one.

## Revoking a token

From **Settings → API & MCP**, click **Revoke** next to any token. Revocation is
immediate: the next `/mcp` request using that token gets

```
unauthorized: invalid or revoked API token - generate one in Settings → API tokens.
```

Revoke a token if it leaks (e.g. pasted somewhere public) or if you're decommissioning
a machine/agent that had it. There's no way to "pause" a token - revoking is permanent;
mint a new one to reconnect.

## Scope

When you mint a token you choose its scope:

| Scope     | Can use                                                                         | Cannot use                                           |
| --------- | ------------------------------------------------------------------------------- | ---------------------------------------------------- |
| **Full**  | Every tool, including `list_submissions` (reading submission content).          | Nothing.                                             |
| **Setup** | `create_form`, `get_snippet`, `list_forms`, `get_form`, `send_test_submission`. | `list_submissions` - reading submissions is blocked. |

A **setup** token is the safe default for handing to an autonomous coding agent that only
needs to create and wire forms: it can do the whole setup and verify loop but can never
read a visitor's submitted content. A setup token calling `list_submissions` gets a
`forbidden` error. Existing tokens are full by default. A token is always owner-scoped -
it can only ever act on the account it belongs to, regardless of scope.

## Access key vs. API token

These are two different credentials with different security postures - don't confuse
them:

|                     | `access_key` (`fp_…`)                                        | API token (`fpat_…`)           |
| ------------------- | ------------------------------------------------------------ | ------------------------------ |
| Used on             | `POST /submit`                                               | `POST /mcp`                    |
| Sent as             | a form field in the request body                             | `Authorization: Bearer` header |
| Belongs to          | one form                                                     | your whole account             |
| Meant to be public? | Yes - designed to sit in public page source                  | No - treat it like a password  |
| Where it's issued   | dashboard Setup tab, or [`create_form`](/docs/agents/create-form) | Settings → API & MCP           |

If you're wiring a `<form>` to accept visitor submissions, you want the `access_key`.
If you're connecting an agent to manage forms via MCP, you want the API token.

<CardGroup cols={2}>
  <Card title="MCP server" icon="server" href="/docs/agents/mcp-server">
    Where this token gets used.
  </Card>

  <Card title="Your first form" icon="inbox" href="/docs/first-form">
    Where a form's access\_key comes from instead.
  </Card>
</CardGroup>