For clients that cannot sign in through a browser.

Which way in is yours

There is one endpoint, https://letsweft.com/api/mcp, and two ways to prove who you are.

• OAuth — the default, and the better one. Your client registers itself, you sign in once in a browser, and no secret is ever written into a config file. Claude, ChatGPT, Cursor, VS Code, Kimi Code CLI and most others do this. If your client offers it, stop reading: you do not need a token.
• An access token — for clients whose MCP support is a URL and a header. DeepSeek Harness, Trae, Qoder, CodeBuddy, iFlow CLI are all in this group.

Minting one

Open Settings → Access tokens.

Give it a name you will recognise in six months — "Trae on the laptop", not "token 2" — and pick an expiry: 30, 90 or 365 days, or never. Never is the default, on purpose: a credential that dies quietly in the middle of a run fails an agent worse than a long-lived one does. The token appears once. Weft stores only a hash of it, so there is no page, no support request and no database query that can show it to you again.

It goes in the Authorization header, next to the endpoint: Authorization: Bearer wft_…. Every client page shows the exact command or config file for that client.

What a token can do

Everything your account can: read the board, create and move tasks, run sprints, record decisions — all 32 MCP tools, across your whole workspace. There are no scopes yet, so a read-only token is not something you can make today. Treat it as you would your password. That is what the bearer-token spec asks of every client too: RFC 6750 defines a bearer token as a credential that anyone holding it can use, says it must be protected from disclosure, and warns against putting it in a page URL. Keep it out of logs as well: OWASP recommends removing or masking access tokens in recorded application data.

What it cannot do is sign in to the website, change your billing, or reach any workspace you are not a member of.

Revoking, and knowing it worked

Revoke from the same panel. It takes effect on the next call — no propagation delay, no cached grace period — and the calls the token already made stay in your history rather than vanishing with it. Revoke when a machine is lost, when a laptop leaves the company, when a token has been pasted somewhere it should not have been, or simply when you stop using a client.

Each token in the list shows when it was last used. That line is the honest test of whether a client is connected: a client that set up correctly but never called a tool shows never used, and a config that looks right but never reached us shows the same. If your assistant says it cannot see your board, check that line first.