Access tokens & CLIs

An access token lets an agent reach your workspaces when nobody is there to sign in. Every agent, signed in or on a token, connects to the same MCP server:

https://www.everythings.app/api/mcp

When to use a token

Claude, ChatGPT, Gemini and the Claude Code plugin sign in with OAuth. You approve the agent on an Everythings screen once, and the app keeps the connection with no token to copy.

A token is for a run with no browser and no person at the keyboard:

A CLI on a server, such as claude -p or the Gemini CLI.
A job in CI.
A routine that runs on a schedule while you are away.
Any MCP client that takes a URL and a header but cannot run a sign-in.

Create a token

Open Settings and find the MCP Access Tokens card. The ? button beside its title (Integration guide) opens a short guide for Claude, ChatGPT and Gemini.
Type a name in the token name field. Name it after the agent, such as “Claude Code on the build server”: the app labels everything the agent writes with this name.
Pick Read only (selected at first) or Read & write.
Press Create token.
Copy the token from the box that appears, with the copy button beside it, and store it somewhere safe. It starts with nthings_mcp_ and is shown once.

You can't view a token again after you leave the page. If you lose it, create a new one and revoke the old one.

Tokens need a full account. A guest trying Everythings in the Sandbox has no Settings menu, and the server refuses a token for a guest. Sign up in the Sandbox bar first: your sandbox workspaces stay yours.

Read only or read & write

The scope decides what the agent can do. Either scope reaches every workspace you can open.

Read only

The agent can search and read your workspaces, things, comments and marks, see the answers to questions it asked, and check what changed since its last run. Nothing it does changes your data. Start here.

Read & write

Adds creating, editing, moving, copying, deleting (to Trash) and restoring things, plus comments, marks, asking you questions and closing @Agent jobs. Emptying Trash and deleting a workspace stay yours to do in the app. Grant this only when the agent needs it.

The Tools reference lists which tools each scope allows.

Add it to a client

Replace nthings_mcp_YOUR_TOKEN with your token in each snippet. The server speaks streamable HTTP; use the www address exactly as shown.

Claude Code

For a Claude Code run where nobody can sign in, such as claude -p on a server or in CI:

claude mcp add --transport http everythings https://www.everythings.app/api/mcp --header "Authorization: Bearer nthings_mcp_YOUR_TOKEN"

Skip this where the Everythings plugin is installed. The plugin already adds a server named everythings that signs in with OAuth, and a second server with that name would clash with it.

Gemini CLI

Add the server from the command line:

gemini mcp add --transport http everythings https://www.everythings.app/api/mcp --header "Authorization: Bearer nthings_mcp_YOUR_TOKEN"

Or add it to ~/.gemini/settings.json:

{
  "mcpServers": {
    "everythings": {
      "httpUrl": "https://www.everythings.app/api/mcp",
      "headers": { "Authorization": "Bearer nthings_mcp_YOUR_TOKEN" }
    }
  }
}

Other MCP clients

A client that reads its servers from a JSON file usually takes an entry like this one. Field names vary between clients, so check yours.

{
  "mcpServers": {
    "everythings": {
      "type": "http",
      "url": "https://www.everythings.app/api/mcp",
      "headers": { "Authorization": "Bearer nthings_mcp_YOUR_TOKEN" }
    }
  }
}

The name on its work

Everything an agent writes carries its name: ✦ and the agent's name on a thing it wrote, a ✦ on that thing's tile, “agent” after your name on its marks, and “via” the agent on its comments and in the notifications other members get for its new things and edits.

An agent that signed in is named after the app as it registered with Everythings, such as Claude or ChatGPT.
An agent on a token is named after the token.
The name also keeps each agent's own place: its what_changed cursor and its count of how people marked its work. Two tokens with the same name share both.
What an agent already wrote keeps its name after you revoke the token.

The list in Settings

Under the form, the MCP Access Tokens card lists every active token, newest first. Agents you connected by signing in appear there too, as OAuth: followed by the app's name, so tokens and connected apps sit side by side.

Each row shows the name and the scope: read only or read & write.
Next to the scope, last used gives the date of the latest call, or never used.
The trash-can button on the right, Revoke, ends that token.
With nothing active, the card reads No active tokens.

To check a new setup, have the agent make one call, such as listing your workspaces, then reload Settings: its row should show today's date as last used.

Revoke a token

Open Settings and find the token in the MCP Access Tokens list.
Press the trash-can button, Revoke. The row leaves the list.

Revoking takes effect within a minute. The server remembers a token it has checked for up to 60 seconds, so a call in that window can still go through; after it, every call with the token is refused. Your other tokens and apps keep working.

The same button disconnects an app you signed in to. Revoking its OAuth: row ends every token that app holds for you, refresh tokens included, so its next refresh fails and its calls are refused within the same minute. Removing Everythings from the app's own connector settings afterwards only tidies its list.

Keep tokens safe

Treat a token like a password. Anyone holding it can do what its scope allows in every workspace you can open.
Give each agent its own token, named after it. You can then tell its work apart and revoke it alone.
Choose Read only unless the agent needs to write.
Keep the token in your CI's secret store or an environment variable, out of files you commit.
If a token may have leaked, revoke it and create a new one.

Questions

Do I need a token to connect Claude, ChatGPT or Gemini?

No. The apps sign in with OAuth: you approve the agent on an Everythings screen and there is nothing to copy. See Claude, ChatGPT & Codex and Gemini. The Claude Code plugin signs in the same way.

Can I limit a token to one workspace?

A token reaches every workspace your account can open: your own and the ones shared with you. Its scope decides what the agent can do, in all of them alike.

I lost my token. Can I see it again?

Everythings stores only a hash of each token, so it can show the token once, right after you create it. Create a new token for the agent and revoke the old one.

Does a token expire?

A token you create in Settings works until you revoke it. Tokens that apps receive when they sign in are renewed by the app on its own.

Why does a connected app show up more than once in the list?

An app that signed in renews its token from time to time, and each renewal adds a row named OAuth: and the app's name. Each row shows when its own token was last used.

Can two agents share one token?

They can, but the app then labels both with the same name, they share one what_changed cursor, and revoking the token stops both. One token per agent keeps each one's work and history apart.

Is this the same as the AI Provider key in Settings?

They are separate settings. The AI Provider key powers Everythings' own voice and AI features. An MCP access token works in the other direction: it lets an outside agent reach your Everythings data.