API tokens

Creating one

1. Open Settings → API Tokens
   From the workspace dashboard.
2. Create a token and name it after its use
   One per client — “Cursor on the laptop”, “CI” — so revoking one does not take the others down with it.
3. Copy it once
   The value is shown at creation and not again. If you lose it, revoke it and make another.

Using one

MCP clients ask for it when you add the server; see Other clients. The CLI stores it after htflow login.

Keeping them safe

• A token carries your workspace access. Treat it like a password.
• Never commit one. Put it in an environment variable or your client's own credential store.
• Revoke anything you are no longer using — an unused token is only a liability.