# Credentials for MCP, CLI and API

Source: https://docs.fortrabbit.com/platform/automation/credentials
Published: 2026-11-10
Reviewed: 2026-11-10

> Which credential works for the fortrabbit MCP server, the frbit CLI and the public API, and what each one may read, write and delete.


## About credentials

A browser sign-in starts in the MCP client or with `frbit auth login`. A person approves it in the dashboard, and the tool stores and renews it. An API token is created in the dashboard and pasted where needed.

A browser sign-in works only for the tool that started it. An API token works everywhere.

## Where each credential works

| Credential   | MCP server | CLI and public API |
| ------------ | ---------- | ------------------ |
| MCP sign-in  | Yes        | No                 |
| CLI sign-in  | No         | Yes                |
| API token    | Yes        | Yes                |

Agent skills hold no credential of their own. They use the MCP server or the CLI.

## What each credential may do

| Credential                         | Read | Write | Delete       |
| ---------------------------------- | ---- | ----- | ------------ |
| MCP sign-in                        | Yes  | Yes   | Not offered  |
| CLI sign-in                        | Yes  | Yes   | When allowed |
| API token, read                    | Yes  | No    | No           |
| API token, read and write          | Yes  | Yes   | No           |
| API token, read, write and delete  | Yes  | Yes   | Yes          |

Write means create and change. Over MCP, an agent creates apps and environments, changes environment variables, deploys and restarts. No MCP tool deletes, so the delete permission changes nothing there.

API token permissions apply on the MCP server too: a read-only token calls the read tools only.

The CLI sign-in deletes only when `Allow deletes` was ticked on approval. Restoring a backup and switching a component off count as deletes, see [token permissions](/platform/automation/api#token-permissions).

## Lifetime and revocation

|         | Browser sign-in                                | API token     |
| ------- | ---------------------------------------------- | ------------- |
| Created | MCP client, `frbit auth login`                 | Dashboard     |
| Expires | 1 year after approval, or after 30 days unused | Never         |
| Revoke  | `AI agents` in the account menu                | `API tokens`  |

## Which one to use

- A person at their own computer: the browser sign-in.
- A CI job, a script or a server: an API token with the smallest permission that covers the job.
- An MCP client without OAuth support: an API token, read-only unless the agent should change things.

---

- [Agent setup](/platform/automation/agents)
- [MCP server](/platform/automation/mcp)
- [CLI](/platform/automation/cli)
- [Public API](/platform/automation/api)