Authentication

Personal access tokens

Open Settings → Security in the Funkel AI app. Create a token with a clear integration name.

Copy the token immediately. Funkel AI shows its full value only when you create it.

Send the token in the Authorization header. Tokens begin with funkel_pat_.

Authorization: Bearer <FUNKEL_PERSONAL_ACCESS_TOKEN>

Token lifetime

You can choose 7, 30, 60, 90, 180, or 365 days. Zero means no expiry.

Each account can hold up to 20 active tokens. Token names have a 64-character limit.

Revoke unused tokens in Settings → Security. Create a replacement before removing a token that an integration needs.

Account and product access

A token identifies its owner. Resource checks still enforce account ownership, product access, permissions, and plan limits.

Tokens do not offer selectable read-only scopes. Give each integration its own token and protect it like a password.

The API reference identifies routes that require a browser session or use another authentication method.

MCP write approval requires your own authenticated browser session. A personal access token cannot approve the action.

Authentication errors

Check the token and Authorization header after a 401 response. Replace expired or revoked tokens.

A 403 response indicates denied access or a workspace restriction. Read the response before changing permissions.

MCP OAuth tokens work with /mcp. Use a personal access token for REST integration requests.