Skip to main content
Settings MCP token modal with name, expiration, and scope fields A personal access token (PAT) signs an MCP client or the Jam CLI in to Jam without the browser sign-in. Use one wherever a browser is not available: a CI job, a coding agent on a server, a Docker container, or WSL. For everyday use on your own machine, the browser sign-in is simpler and needs no token. Each token belongs to your account, works in one workspace, and expires on a date you pick.
Jam stores only a hash of the token. You cannot see it again after you create it. Copy it right away and store it in a secret manager or environment variable.

​
Create a token

1

Open Settings → MCP

Go to Settings → MCP and scroll to Personal Access Tokens. Settings → CLI has the same Create token button.
2

Click Create token

Fill in:
  • Name: what will use it, such as “GitHub Actions” or “Claude Code on the build box”.
  • Expiration: 7 days, 30 days, 90 days, or 1 year.
  • Permissions: tick Jam CLI, MCP, or both, and pick Read-only or Read and write for each. See Permissions.
3

Copy the token

Click Create and copy the token. It starts with jam_pat_, which lets secret scanners catch one that leaks into a repository.

​
Use the token

Pipe the token into the login command once. The CLI stores it with 0600 permissions and uses it for every command:
In CI, skip the login and set JAM_TOKEN instead. The CLI uses it for the life of the process and never writes it to disk:
See Record end-to-end tests for a CI job that uses it.

​
Permissions

A token carries a permission per product. Tick the product the token is for, then pick its access. Both default to read-only, and a token can cover both products at once. The token never gets more than your own role allows, so a read-and-write token held by a Viewer still cannot delete a Jam. Pick read-only for an agent that only investigates. Pick read and write when the agent should comment on Jams, file them into folders, or record proof. The MCP server checks for the MCP scopes, so a token ticked only for the CLI does not work in an MCP client.

​
Manage tokens

Settings → MCP lists every token in the current workspace with its name, scopes, last use, and expiry. To revoke one, open the … menu on its row, select Revoke token, and confirm.
Revoking is permanent. Every client that holds the token loses access at once. Create a new token and update the client to restore it.
An expired token stops working on its own. Create a new one and update the client that used it.

​
Keep tokens safe

  • Pick the shortest expiry that fits. 7 days for a trial, 30 for active work, 90 days or 1 year for a pipeline you maintain.
  • One token per client. Revoke one without breaking the others, and read the last used column to see which client is active.
  • Never commit a token. Keep it in an environment variable or your CI’s secret store. The jam_pat_ prefix helps secret scanners catch one that slips through.
  • Revoke on any suspicion. If a token might have leaked, revoke it first and create a replacement after.