# Sign-in and tokens

> Browser sign-in, personal access tokens, scopes and how to revoke access.

Source: https://docs.archee.studio/mcp/authentication

Archee MCP accepts two kinds of credentials. Both act as you, inside your plan, and both can be revoked at any time.

| Method | Best for | Lifetime |
| --- | --- | --- |
| Browser sign-in (OAuth) | Interactive clients: Claude Code, Cursor, Claude Desktop | Refreshes itself; the refresh token lasts 30 days from its last use |
| Personal access token `arch_pat_…` | CI, scripts, headless agents | 7, 30 or 90 days, chosen when you create it |

## Browser sign-in

Clients that support remote MCP servers discover Archee's sign-in automatically. On first use the client opens your browser; you sign in, see which scopes the client asks for and approve. The client then holds short-lived access tokens and refreshes them on its own.

Archee uses OAuth 2.1 with PKCE. A refresh token can be used once: if a used one comes back, Archee treats it as stolen and ends that whole sign-in.

## Personal access tokens

1. In the web app open **Settings → Connected apps and tokens**.
2. Create a token, pick its scopes and an expiry.
3. Copy it. It is shown once and cannot be recovered; create a new one if you lose it.

Keep tokens in an environment variable or a secret store, never in a repository.

## Scopes

A connection holds only the scopes you approved, and never more than your plan allows.

| Scope | Allows |
| --- | --- |
| `mcp:search` | Finding SDK functions with `search` |
| `mcp:execute` | Running programs with `execute` |
| `files:write` | Uploading files to a project |
| `kb:read` | Knowledge Base search and pages |
| `verify` | TCVN drawing checks |
| `deliver` | Packaging deliverables |
| `agent:run` | Handing long work to Archee's agent |

A client that asks for no scope gets `mcp:search` and `mcp:execute`. A program that calls a function outside its scopes gets a `ScopeDenied` error naming the missing scope.

## Revoke access

Under **Settings → Connected apps and tokens**, revoke a connected app or a token. The next request it makes is refused. Revoking a connected app also ends its refresh tokens, so it cannot sign itself back in without you.

If your plan stops including MCP, every connection stops working within about a minute and works again if the plan is restored.