Agent tokens
An agent needs its own credential, not a copy of yours
A coding agent running in CI has no browser and no one to click a login link. Handing it a user's session is the usual shortcut, and it is the wrong one: the session expires mid-job, and revoking it logs out a person. CodyCody issues agent tokens instead — credentials that belong to the agent, last as long as you decide, and can be revoked without touching anything else.
The token goes in the MCP configuration as a bearer header. That is the entire integration: the agent authenticates to the engine the same way from a laptop, a build runner or a scheduled job, and the engine knows which profile's workflows and seat it is acting under.
The facts
- ✓Tokens are long-lived, issued per agent, and revocable individually.
- ✓They are separate from browser sessions: revoking one never logs anyone out.
- ✓They are bound to a profile, so the engine's seat accounting and library apply to the agent's runs.
- ✓The same configuration works for a local agent, a CI runner and a scheduled job.
The problem
Where it goes wrong without rails
Browser sessions expire, and a CI job that authenticates with one fails at the worst hour.
Sharing a personal credential with an automation means revoking it revokes a person.
With one credential for everything, you cannot tell in the engine's log which agent did what.
How it works
What the engine does about it
- 1
Create a token in the engine
On the Agent Tokens page of the engine's web interface, create a token for the agent or job. The secret is shown once. Name it for what will hold it.
- 2
Put it in the MCP configuration
One entry: the engine's streamable HTTP endpoint and an Authorization header carrying the token. Claude Code, Codex and any MCP client read the same shape.
- 3
Run, from anywhere
The agent calls ccw_start and the engine serves it the workflow under the token's profile. Nothing about the job depends on a person being logged in.
- 4
Revoke on its own
A token is revoked individually. The job it belonged to stops being able to start workflows; every other token and every user session is unaffected.
Questions
Asked before buying
- Does an agent token count as a seat?
- A seat is a personal profile. A token acts under a profile, so it uses that profile's seat rather than adding one.
- Can I see which token ran a workflow?
- Runs are recorded against the profile and token that started them, so the engine's instance list and logs tell you which agent did what.
- What if a token leaks?
- Revoke it on the Agent Tokens page. The credential stops working immediately; nothing else needs to be rotated.
Start with
The packages that fit
- Code Quality →
Run a full ISO/IEC 5055 and Clean Code assessment of any codebase with your coding agent, every check its own verified step. Free with every CodyCody plan.
- Boy Scout Coding →
A code change by your coding agent: scoped, designed, approved at two human gates, reviewed from three angles, covered by tests — and the code left cleaner.
Every plan and what it includes is on the pricing page.