API tokens

Scoped tokens for programmatic access: CI pipelines, CLI tools, and scripts that need to read or write vault data without a human in the loop.

The design

• A token is created with a name and a set of scopes — read-only vault access, write access, MCP access
• The raw value is shown once, at creation; if lost, revoke and create a new one
• Revocation is immediate: calls using a revoked token fail with 401 Unauthorized

Where this stands on Poly

Token issuance is not exposed on this platform yet. Today the vault is reachable from inside Poly — the Secrets panel and MCP-enabled agents. When issuance lands, this page documents the scopes and the endpoints. Until then there is nothing to create — and nothing to leak.