Tokens and access
Anything that isn’t your browser uses a token: the CLI, an AI client connected over MCP, a script or a CI job. A token never does more than you can.
Access per workspace
Section titled “Access per workspace”When you approve a token, you choose its access in each workspace separately:
| Access | Can |
|---|---|
| View | Read docs and their History |
| Publish | Read, publish, rename and restore docs; make projects and folders; take a public link back |
| Everything | Publish, plus comments when they arrive |
| No access | Nothing in that workspace |
No token can delete docs, share with people, or make an existing doc public. Those happen in the app.
Two kinds
Section titled “Two kinds”Sign-in tokens are approved in your browser: dockito login, and AI clients that sign in by themselves. They renew on their own and end after 90 days without use. They’re listed in Account → Sessions and devices, where Sign out ends one.
Personal tokens are made by hand in Account → Tokens for clients that can’t sign in, scripts and CI. Each lasts 7, 30 or 90 days, or until a date up to a year away. There’s no never-expiring token. You can have up to 20 at a time, and Revoke ends one.
Token secrets start with dkt_. Dockito stores only a hash, so a token is shown once, when it’s made.
Changing access
Section titled “Changing access”- The CLI:
dockito login --updateopens the browser to change its access. - An AI client: sign it out and connect again.
- A personal token: make a new one with the access you want and revoke the old one.
Removing someone from a workspace stops all their tokens there at once.