Organization and project tokens

Organization tokens (sdb_org_…) for your backend and short-lived project tokens (sdb_prj_…) for agents and tasks: scopes, project restriction, IP allowlist, expiry, rate limits.

#Organization tokens

Created by an owner or administrator in Organization › API tokens (or POST /organizations/<org>/tokens with a personal credential). They belong to the organization, keep working when people leave, and are shown once. Revoking one also revokes every project token made from it.

Scope	Allows
`projects:read`	List and read projects (always included)
`projects:write`	Create, change, pause, restore, delete projects; rotate keys; per-project limits; claim links. Needed to read service_role keys and database passwords.
`database:read` / `database:write`	Read-only SQL, types, dumps / SQL writes and migrations
`functions:write` / `secrets:write`	Deploy Edge Functions / set their secrets. Functions run with the project’s service_role key, so `functions:write` effectively allows full access to the project’s data: give it only to code you trust.
`auth:write`	Change Auth settings
`usage:read`	Usage and metering
`webhooks:write`	Manage webhook endpoints
`billing:read`	Plan, limits and billing state

Options: project_refs (only these projects), ip_allowlist (addresses or CIDR ranges), expires_in_days, rate_per_sec (1-200, bursts of 20× that). A token never creates other organization tokens.

#Short-lived project tokens

Give an AI agent, a job or a customer session exactly one project for a limited time:

Terminal

curl -X POST https://stitchdb.com/platform/v1/projects/<ref>/tokens \
  -H "Authorization: Bearer $STITCHDB_TOKEN" -H 'Content-Type: application/json' \
  -d '{ "scopes": ["database:read"], "expires_in": 900, "name": "agent task 42" }'

One project only; at most the scopes of the token that made it; at most 24 hours (and never longer than its parent).
No organization powers: it cannot create or delete projects, manage webhooks or mint tokens.
Without database:write every SQL statement runs in a read-only transaction, also through MCP.
Revoke early with DELETE /projects/<ref>/tokens/<id> (a project token may also revoke itself).