Create and manage access tokens.

A token is how a token-based client proves it's you. You make one in Settings, copy it once, and revoke it the moment you don't need it. Here's everything a token controls.

4 min read MCP Updated Jul 2026

A token lets a client that pastes a credential — Cursor, Claude Desktop, Claude Code, and other multi-model clients — prove the request is coming from you. Sign-in clients like Claude.ai on the web and ChatGPT don't need one; they authorise you when you connect. Every token starts with sr_mcp_.

Create a token

Open Settings → MCP

In ScoutRival, go to Settings and choose MCP. This is a Starter-and-up feature — on the Free plan you'll see an upgrade prompt here instead.

Start a new token

Choose New token, then set a label, an access level, a brand scope, and — if you want one — a daily credit cap. The next section explains each field.

Create it and copy it now

The token is shown once. We store only a scrambled hash of it and genuinely can't show it again. Copy it straight away, along with the config block on the same screen. If you lose it, revoke it and make a new one.

// SHOWN ONCE

Copy the token the moment it appears. ScoutRival keeps only a scrambled hash of it, so there is no way for us to recover the original — even for you. That's a security feature, not an inconvenience: if we can't read your token, neither can anyone who reaches our storage.

What each field does

Four settings shape what a token can do. You can create as many tokens as you need, each with its own settings.

Field	What it does
Label	A name so you recognise the token later, for example Cursor on my laptop.
Access level	Read-only, Content or Full — see scopes and access levels. Defaults to Read-only.
Brand scope	All your brands, or restrict the token to specific brands so it can't touch the others.
Daily credit cap	Off by default. Set a number to stop this token spending more than that many credits per day.

Use it in your client

The token goes into your assistant's MCP settings. It travels in the Authorization header as Bearer sr_mcp_…:

mcpServers config{
  "mcpServers": {
    "scoutrival": {
      "url": "https://user.scoutrival.com/api/mcp",
      "headers": { "Authorization": "Bearer sr_mcp_YOUR_TOKEN" }
    }
  }
}

The token works for any brand inside its scope. You don't pick a brand in the config — the client picks it by name when you ask, for example "Give me today's brief for <your brand>."

Revoke a token

Revoking is instant and permanent. The moment you revoke a token, it stops working everywhere it's pasted — there's no grace period and no undo. To carry on, make a new token and update your client with it.

Rotate your tokens from time to time, the same way you would any long-lived credential.
Give each device its own token, so you can revoke one without breaking the others.

Keeping tokens safe

Start Read-only. It reads your data and spends nothing — raise the access level only when you need to.
One token per device. Revoking a lost laptop's token then leaves every other device working.
Set a daily cap on Content and Full tokens. It puts a ceiling on what a token can spend in a day.
Treat the config file as a secret. A token sitting in a config file is a live credential — protect the file accordingly, and don't commit it to a shared repository.
Revoke anything you're unsure about. It's free, it's instant, and making a fresh token takes a minute.

Still stuck?

Contact support