# Tokens and access

> How the CLI, MCP connectors and personal tokens are allowed in, and how to sign them out.

Anything that isn't your browser uses a token: the CLI, an AI client connected over MCP, a script or a CI job. A token never does more than you can.

## Access per workspace

When you approve a token, you choose its access in **each** workspace separately:

| Access | Can |
|---|---|
| **View** | Read docs and their History |
| **Publish** | Read, publish, rename and restore docs; make projects and folders; take a public link back |
| **Everything** | Publish, plus comments when they arrive |
| **No access** | Nothing in that workspace |

No token can delete docs, share with people, or make an existing doc public. Those happen in the app.

## Two kinds

**Sign-in tokens** are approved in your browser: `dockito login`, and AI clients that sign in by themselves. They renew on their own and end after **90 days without use**. They're listed in **Account → Sessions and devices**, where **Sign out** ends one.

**Personal tokens** are made by hand in **Account → Tokens** for clients that can't sign in, scripts and CI. Each lasts 7, 30 or 90 days, or until a date up to a year away. There's no never-expiring token. You can have up to 20 at a time, and **Revoke** ends one.

Token secrets start with `dkt_`. Dockito stores only a hash, so a token is shown once, when it's made.

## Changing access

- The CLI: `dockito login --update` opens the browser to change its access.
- An AI client: sign it out and connect again.
- A personal token: make a new one with the access you want and revoke the old one.

Removing someone from a workspace stops all their tokens there at once.