Sign-in and tokens
Browser sign-in, personal access tokens, scopes and how to revoke access.
Archee MCP accepts two kinds of credentials. Both act as you, inside your plan, and both can be revoked at any time.
| Method | Best for | Lifetime |
|---|---|---|
| Browser sign-in (OAuth) | Interactive clients: Claude Code, Cursor, Claude Desktop | Refreshes itself; the refresh token lasts 30 days from its last use |
Personal access token arch_pat_… |
CI, scripts, headless agents | 7, 30 or 90 days, chosen when you create it |
Browser sign-in
Clients that support remote MCP servers discover Archee’s sign-in automatically. On first use the client opens your browser; you sign in, see which scopes the client asks for and approve. The client then holds short-lived access tokens and refreshes them on its own.
Archee uses OAuth 2.1 with PKCE. A refresh token can be used once: if a used one comes back, Archee treats it as stolen and ends that whole sign-in.
Personal access tokens
- In the web app open Settings → Connected apps and tokens.
- Create a token, pick its scopes and an expiry.
- Copy it. It is shown once and cannot be recovered; create a new one if you lose it.
Keep tokens in an environment variable or a secret store, never in a repository.
Scopes
A connection holds only the scopes you approved, and never more than your plan allows.
| Scope | Allows |
|---|---|
mcp:search |
Finding SDK functions with search |
mcp:execute |
Running programs with execute |
files:write |
Uploading files to a project |
kb:read |
Knowledge Base search and pages |
verify |
TCVN drawing checks |
deliver |
Packaging deliverables |
agent:run |
Handing long work to Archee’s agent |
A client that asks for no scope gets mcp:search and mcp:execute. A program that calls a function outside its scopes gets a ScopeDenied error naming the missing scope.
Revoke access
Under Settings → Connected apps and tokens, revoke a connected app or a token. The next request it makes is refused. Revoking a connected app also ends its refresh tokens, so it cannot sign itself back in without you.
If your plan stops including MCP, every connection stops working within about a minute and works again if the plan is restored.