# API tokens & service accounts

An API token lets a program authenticate to Koo — the [CLI](/docs/developers/cli), the SDKs, or direct calls to the [REST API](/docs/developers/api). Each token is a **service account**: a machine identity with a name and a role, confined to a single account.

## Create a token

Open the account's **Tokens** page in the console and create a token with a name and a role. Koo shows the plaintext token — a bearer credential starting `kc_…` — **once**, at creation. Copy it then; afterwards the page shows only a masked prefix, and Koo cannot show the full value again. If you lose a token, revoke it and create a new one.

## Roles

A token holds one role, chosen when you create it:

- 
-

A token acts with exactly that role's permissions (see [Teams & roles](/docs/collaboration/teams-and-roles)), and only within the account it was created in — it can never act in another account, and it can never manage members, plan, or billing.

## Use a token

Send the token as a bearer credential on every request to the [Koo API](/api):

```text
Authorization: Bearer kc_…
```

The [CLI](/docs/developers/cli) reads the same token from the `KOO_TOKEN` environment variable, so a single credential covers your terminal, your CI pipeline, and your own scripts. The [Node SDK](/docs/developers/sdk-node), [Go SDK](/docs/developers/sdk-go), and [headless use of the remote MCP server](/docs/developers/remote-mcp#headless-ci) authenticate with it too.

You do not need a token to connect an agent interactively: an agent reaches the [remote MCP server](/docs/developers/remote-mcp) by URL and you authorize it in the browser with Sign in with Koo. That authorization is confined the same way a token is — one account, Read or Write — and you revoke it from the console's **Connections** page rather than the Tokens page.

## Manage tokens

- 
- 
-

> **Warning:**
>
> Treat tokens like passwords. Keep them in your CI provider's secret store, never in source control, and create a separate token per system so any one can be revoked without disrupting the others.