Skip to content
Open Breno

Tokens

Create a personal token under Connect AI, choose its scopes and expiry, copy it once, and revoke it. What it can see, and when it stops working.

Report a problem with this page

A personal token lets your own tools use Breno as you. It starts with sirmx_mcp_, belongs to you in one workspace, and works on both the MCP server and the REST API.

Create a token#

  1. Open Connect AI in the left navigation.
  2. Create a token and give it a name you will recognize, such as "Cursor on my laptop".
  3. Choose its scopes and its expiry.
  4. Copy it now. It is shown only once. If you lose it, revoke it and create another.

Scopes#

ScopeLets the token
readList and read items, search passages, list connectors and connected sources.
askGet a grounded answer with citations (this spends coins).
exportExport what you can read.
writeUpload a file, capture a link, save a note, and edit your own notes.

Give a token only the scopes it needs. A tool that only searches needs only read. See Authentication for the operation each scope allows.

What a token can see#

Exactly what you can see: the spaces you belong to, the sensitivity labels you are cleared for, and your own private items. It cannot see another member's Only me items, and a confidential item is invisible to a token without the grant. A viewer's token cannot write.

When a token stops working#

Immediately, the moment any of these happens:

  • you revoke it;
  • it expires;
  • you leave the workspace, or are removed from it;
  • your account is erased;
  • the workspace is deleted.

Send it#

Every request
Authorization: Bearer sirmx_mcp_…

Keep it like a password: do not commit it, paste it into a shared document, or send it in chat. If you think it has leaked, revoke it in Connect AI.

OAuth tokens are different#

When Breno is added to a tool by URL, the tool receives its own token through an OAuth flow. Those tokens work on MCP only; the REST API refuses them with 401 TOKEN_AUDIENCE_MISMATCH. See Connect a client.

Rate limits#

120 requests a minute per token, and 300 a minute per IP address for token traffic. See Rate limits.