API & MCP tokens

Create and scope access tokens so tools, scripts, and AI apps can work with your SearchChamp data — and revoke them anytime.

When you want a script, an integration, or an AI app to work with your SearchChamp data programmatically, you give it a token instead of your password. Tokens are scoped to what they're allowed to do and can be revoked at any time, so access stays under your control.

What you'll need

An account with permission to manage tokens (typically an owner or admin).
The tool or app you want to connect.

Create a token

Open your token settings

In SearchChamp, open Settings and find API keys or MCP tokens, depending on what you're connecting:

API keys — for scripts and custom integrations calling the SearchChamp API.
MCP tokens — for connecting an AI app over the Model Context Protocol, including developer tools like Claude Code.

Name and scope it

Give the token a clear name (so you remember what it's for) and grant only the scopes it needs. A read-only integration should never be given write or publish access.

Copy it once and store it safely

The token is shown once, at creation. Copy it immediately and store it in a secure secret store or environment variable. If you lose it, revoke it and create a new one — you can't view it again.

Revoke when you're done

When a token is no longer needed — a project ends, a tool is retired, or a token may have leaked — revoke it from the same settings screen. Revoking takes effect immediately.

Keep tokens secret

Treat a token like a password — anyone who has it can act with its scopes.
Never paste a token into a chat, a ticket, a screenshot, or a public repository.
Store it in an environment variable or a secrets manager, never in your source code.
Rotate tokens periodically and revoke any you suspect has been exposed.

Plan availability

Programmatic access via API keys and MCP tokens is available on paid plans. Managing tokens is free; the work they trigger uses your normal credit allowances, and anything that spends credits or publishes still respects your approval settings.

FAQs

What's the difference between an API key and an MCP token? An API key is for scripts and integrations calling the API directly. An MCP token connects an AI app over the Model Context Protocol. Both are scoped and revocable.

I lost my token. Can I see it again? No — tokens are shown once at creation. Revoke the old one and create a new token.

Who can create tokens? Managing tokens is an admin-grade action, typically limited to owners and admins, because a token grants org-level access.

Does a token bypass my approval settings? No. Actions that spend credits or publish still follow your approval rules — a token can propose work, but publishing and spending remain gated.

On this page