Scoped Access Tokens
Entitle each token to the exact servers and tools it should reach. Different users and agents see different tool sets from the same launcher.
Not every agent should be able to reach every tool. A drafting assistant has no business touching your billing account, and a reporting bot doesn’t need send-email scope.
Least privilege, per token
Every token you mint is scoped to a specific set of servers and tools. The launcher manifest is filtered to the caller’s entitlements, so two tokens pointed at the same launcher can see two entirely different tool sets.
Where it fits
- Give a teammate a token limited to analytics and search-console tools
- Hand an autonomous agent a narrow token that can read but not write
- Issue a client-facing token that reaches only that client’s integrations
Enforced at the gate
Entitlements aren’t a client-side convenience — they’re applied when the manifest is served and when each call is authorized. Tighten or widen a token’s scope in the dashboard and the change takes effect on the next request, with no redeploy.
Ready to get started?
Start your free trial today. No credit card required.