# Keep your token safe

_Connect an AI assistant · 2 min read · Updated 2026-10-28 · https://lanachat.ai/guides/ai-security/_

Your MCP token opens your workspace with the boxes you ticked. Treat it like the password of the agency owner.

## The rules

- **One token per assistant.** A token for Claude Code on your Mac, another for Cursor. You can then revoke one without touching the others.
- **Never paste the token in a chat**, not even with your own assistant. It goes in the configuration only: the `claude mcp add` command, `config.toml`, or the JSON file.
- **Never in an e-mail, a screenshot, a shared document or a Git repository.**
- **Tick only what you need.** Leave **Spend the balance on licences** off unless you want the assistant to buy licences.
- **Keep the last word.** Without **Publish agency AI**, the assistant can edit and test drafts, never publish nor turn replies on. It also cannot create a creator's first AI Brain: tick the box for that setup, then untick it with **Edit**, or create the brain in the Console first.

## If you think it leaked

1. Open **Users › API & MCP**.
2. Press **Revoke** on the token. It stops working at once; operations already running may finish.
3. Create a new token and put it in your assistant.

## Rotate, renew, revoke

| Action | What happens |
|---|---|
| **Edit** | changes the boxes; the token stays the same |
| **Rotate** | gives a new token; the old one dies at once |
| **Renew** | same as Rotate, for an expired token |
| **Revoke** | kills the token for good |
| **Show revoked tokens** | lists the old ones |

## What the token can never do

- Send a message to a fan.
- Create, change or read another token.
- Reach another agency.
- Read secrets: bot tokens and integration keys are write-only.

> Warning: The Telegram bot token from BotFather is a secret too. If you give it to your assistant to connect a bot, it must pass it once to the tool and never repeat it. You can also add the bot yourself in **Studio › Telegram Accounts**.

## Related

- [Create your MCP token](https://lanachat.ai/guides/ai-create-mcp-token/)
- [Troubleshooting the MCP: 401, 403, missing tools](https://lanachat.ai/guides/ai-troubleshooting/)
- [MCP tool reference: every tool, by screen](https://lanachat.ai/guides/mcp-tool-reference/)