Manage agent tokens

Agent tokens let connected tools manage your VibeUpdate apps through MCP or the agent REST API. Create and revoke them from Agent tokens in the dashboard. You must be signed in with active account access.

Understand the permissionsCopy Anchor Link

A token can manage all apps owned by your account. It is not restricted to one app and is not read-only. An agent using it can create, edit, delete, and restore apps and releases, and publish or unpublish release targets. This includes publishing Required updates.

Tokens cannot create or revoke other tokens. Manage those actions in the dashboard.

Only give a token to a tool you trust with these permissions. A token is a credential, unlike the public app ID used for SDK integration. Do not put it in your mobile app, release notes, public repositories, or shared screenshots.

Create and save a tokenCopy Anchor Link

The complete token is shown only after creation. Save it before leaving or refreshing the page.

1. Open Agent tokens in the sidebar.
2. Under Create a token, enter Token name. Use a name that identifies the tool or device, such as Release assistant. The name must not be empty and can contain up to 100 characters.
3. Choose Expires. The available choices are 30 days, 90 days, 1 year, and Never. The initial choice is 1 year.
4. Select Create token.
5. In Copy this token now. It will not be shown again., select Copy. Copied confirms that the browser copied it.
6. Store the complete token in your tool's private credential storage or a secret manager. Do not save only the last four characters shown in the token list.
7. Turn on I saved this token securely, then select Done to hide the secret.

The token now appears in Your tokens with its name, creation date, and last four characters. The confirmation switch only lets you dismiss the one-time display. It does not verify that the connected tool has saved the token or delay when the token becomes usable.

For an MCP connection, continue with MCP setup.

Replace a tokenCopy Anchor Link

You cannot reveal a token again or edit its expiration from this page. If you lost the secret or need a different expiration:

1. Create a new token and save it securely.
2. Update the connected tool to use the new token.
3. Revoke the old token when you no longer need it.

If a token may have been exposed, revoke it immediately rather than keeping it active during replacement.

Revoke accessCopy Anchor Link

Revocation immediately prevents new requests from authenticating with the token. Agents using it lose access, so check the token name before proceeding. Revoking a token does not undo changes that an agent already made.

1. Open Agent tokens and find the token under Your tokens.
2. Select Revoke.
3. Review the confirmation for that token and select Revoke, or Cancel to leave it active.

After success, Revoked replaces the token's Revoke button. Revocation has no undo control. Create a new token if you need to reconnect the tool.

If an agent loses accessCopy Anchor Link

• Check whether the token is marked Revoked. If it is, reconnect with a new token.
• Check the expiration you chose. Expired tokens stop authenticating, but the current token list does not show an expired badge or the expiration date. A visible Revoke button is not proof that a token is still valid.
• Check that the connected tool saved the complete token. The dashboard cannot show a lost secret again.
• If the error asks you to purchase VibeUpdate, check the owning account's access status. A valid token does not bypass the access requirement.

Do not paste a token into a public issue or support message to diagnose a connection problem.