Personal access tokens let AI tools and scripts use the MCP server on your behalf.
#Create a token
A token acts as you. If you are a member of other organizations, it can also reach their projects, capped by your role there (a read-only role makes every token read-only for that organization); see Teams and roles.
Open Access tokens in the dashboard sidebar and choose:
| Option | Choices |
|---|---|
| Name | Something that tells you where it is used, for example Claude Code on my laptop. |
| Access | Read-only: inspect schemas, run read-only SQL, read logs and advisors. Read-write: also change data and apply migrations. |
| Expires | 7, 30 or 90 days, 1 year, or never. |
| Projects | All your projects (including future ones) or only chosen projects. |
The token (it starts with sdb_pat_) is shown once. StitchDB stores only a hash of it.
#Use a token
Terminal
curl https://stitchdb.com/platform/mcp \
-H "Authorization: Bearer sdb_pat_..." \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'#Last used, revoke and limits
The token list shows when each token was last used. Revoke ends its access within seconds. Each token can make about 120 requests in a burst and 2 per second after that; you can have up to 50 tokens.
Apps connected with OAuth are listed under Authorized apps on the same page, where you can disconnect them.