How to Create an Agent Access Token
An Agent Access token lets a client authenticate to Gavana without your browser session. Tokens are scoped, named, and revocable.
Steps
Step 1: Sign in to Gavana
Step 2: Open Agent Access
Open the account menu and choose Agent Access.
Step 3: Create a token
Give the token a descriptive name (for example, Codex · CLI or Claude · MCP) — this name shows up in node and activity provenance so you can tell which client made a given change.
Step 4: Choose scopes
Select only the permissions the client needs:
| Scope | Grants |
|---|---|
canvas:read | Read canvas graphs |
canvas:write | Change canvases (requires canvas:read) |
asset:read | Read asset references |
image:generate | Generate/edit images, upload local raster inputs, and start any Recipe, including text-only Recipes (requires canvas:read, canvas:write, asset:read) |
video:generate | Discover connected video models and start video work (requires canvas:read and asset:read) |
job:manage | Observe, resume, wait for, and cancel shared Runs; required for default CLI/MCP waiting |
The token form selects dependent scopes automatically — for example, choosing image:generate also enables the three scopes it depends on.
For normal CLI or MCP execution, also select job:manage; without it the
client can start work with --no-wait but cannot poll, wait for, or cancel the
returned Run. A trusted API or CLI backend may instead provide a signed webhook;
Gavana’s worker then keeps the Recipe moving independently while the
original Agent Access token remains revocable. If that token expires or is
revoked before completion, Gavana stops the Recipe with
delegation_revoked and sends its signed failed callback. MCP intentionally
omits webhook secrets from model-visible tool arguments.
Step 5: Set an expiry
Tokens expire after 1–90 days. Choose the shortest expiry that’s practical.
Step 6: Copy the token
Copy the token immediately — Gavana never shows it again after this screen.
Tips
- Use a separate, descriptively named token per client rather than sharing one token across tools.
- You can revoke a token at any time from the Agent Access screen.