Manage FeedbackPulse API Tokens

API tokens let AI assistants authenticate with FeedbackPulse on behalf of a user. Admins manage which users have access and can revoke tokens at any time.

When to use OAuth vs API tokens

Connection type	What to use
Claude Desktop or Claude.ai	OAuth (no manual token needed)
Claude Code, Cursor, or custom scripts	Personal API token

Note

Only Admins can enable MCP access, grant it to other users, and create or manage personal API tokens. Today, an Admin can only create a token for their own account; there is no way for a non-admin user, or an Admin acting on someone else’s behalf, to create a token for another person. If a non-admin needs a token-based connection (for example, Claude Code), an Admin must create the token and share it securely.

Step 1: Enable MCP for your organisation

1. Go to Settings > Features
2. Find AI Integration and toggle it on
3. Click Save

This makes the Settings > Integrations page visible to Admins.

Step 2: Grant access to users

1. Go to Settings > Integrations
2. Find the user in the list and toggle MCP Access on for them
3. Repeat for each user who needs access

Only Admins and Managers can be granted MCP access this way. Admins are granted MCP access automatically and their toggle is locked on; it doesn’t need to be (and can’t be) turned off. Users without MCP access enabled will receive a “Your account does not have MCP access” error if they try to connect.

Step 3: Create an API token

Tokens are required for clients that don’t support OAuth (such as Claude Code, Cursor, or custom scripts). For Claude Desktop and Claude.ai, tokens are managed automatically through OAuth, so you don’t need to create one manually.

Caution

Only Admins can create a personal API token, and only for their own account. There is currently no option to create a token on behalf of another user. If a non-admin needs a token-based connection, an Admin must create the token and share it with that person securely.

If you are an Admin:

1. Go to Settings > Integrations
2. Click Create Token
3. Enter a descriptive name (e.g. “Claude Code - MacBook”)
4. Click Create
5. Copy the token. It is shown only once.

The page will also display a ready-to-use configuration snippet you can paste directly into your AI client. There is no scope selector: every token you create automatically includes both mcp:use and mcp:write.

Token scopes

Scope	What it allows
mcp:use	Read access to surveys, review cycles, peer reviews, recognitions, and employee data
mcp:write	Everything in mcp:use, plus creating survey drafts and creating and updating survey templates

These two scopes describe what a token can do, but you cannot choose between them when creating a token today. Every personal access token an Admin creates includes both mcp:use and mcp:write automatically. OAuth connections (Claude Desktop, Claude.ai) always use mcp:use only; the mcp:write scope is only available via personal access tokens.

Caution

Store the token securely. It cannot be retrieved after the creation screen is closed. If lost, revoke it and create a new one.

Revoking a token

Only Admins can revoke tokens, in Settings > Integrations.

1. Go to Settings > Integrations
2. Find the token in the list and click Revoke
3. Confirm the action

The token stops working immediately. Any connected AI clients using that token will receive an authentication error on their next request.

Token behaviour

Situation	What happens
User account is deactivated	All their tokens are revoked automatically
Token is not used for 90 days	Token remains active (does not auto-expire)
Admin revokes a token	Stops working immediately
OAuth access token expires	Client uses the refresh token to get a new one automatically (1-hour access tokens, 30-day refresh tokens)

Rules and constraints

• Only Admins can toggle MCP access on or off for other users. Admins always have MCP access themselves and cannot be toggled off.
• Only Admins can view, create, or revoke personal API tokens, and an Admin can only create a token for their own account. Non-admin users cannot open Settings > Integrations or manage tokens themselves.
• There is no limit on the number of tokens per user, but each token should have a unique name for easy identification.

---

← Back to MCP Overview