# API tokens

Scoped tokens for programmatic access: CI pipelines, CLI tools, and scripts
that need to read or write vault data without a human in the loop.

## The design

- A token is created with a name and a set of scopes — read-only vault
  access, write access, MCP access
- The raw value is shown **once**, at creation; if lost, revoke and create
  a new one
- Revocation is immediate: calls using a revoked token fail with
  `401 Unauthorized`

## Where this stands on Poly

Token issuance is not exposed on this platform yet. Today the vault is
reachable from inside Poly — the
[Secrets panel](/docs/secrets-about) and
[MCP-enabled agents](/docs/secrets-mcp-integration). When issuance lands,
this page documents the scopes and the endpoints. Until then there is
nothing to create — and nothing to leak.