Tokens for agents
An agent signs in with a personal access token. How to create one is covered under personal access tokens. This page is about which settings suit an agent.
Read only, or write as well
A new token can only read. That is enough for everything an agent wants to know. Lalabase then
refuses the tools create_ticket, post_comment, update_ticket, create_time_session and
mark_notification_read.
If the agent should write, turn off Read-only access. You can also change this later in the token overview without replacing the token.
Start with a read-only token. Give write access once you know how you work with the agent.
Reach
| You want | Choose |
|---|---|
| an agent for one client project | Selected organisations only, and there only this project |
| one organisation with all its projects | Selected organisations only, and there all projects |
| your inbox across all organisations | All organisations, including future ones |
| to read the people directory | a reach with all projects of the organisation |
The reach cannot be changed afterwards. Create a new token for that.
A token limited to some projects does not read that organisation's people directory: to it, the organisation counts as not found there.
Lifetime
You choose 7, 30, 60 or 90 days or a date of your own, no token lasts longer than 90 days. An expired token answers 401. Create a
new one and enter it in your client.
Several tokens
Create one token per agent or purpose and name it accordingly, such as "Claude Code, website project". That way you can see later what it is for and revoke one without touching the others.