Connected Apps and API Tokens

Two pages in My settings control what can use Thicket on your behalf outside the Thicket apps:

• Connected apps lists the AI assistants and other apps you approved through Thicket's sign-in screen, such as ChatGPT or Claude Code connected over MCP.
• API tokens lists the personal access tokens you created for scripts and other tools that call the Thicket API.

To open either page, click your name at the bottom of the sidebar, choose My settings, and click Manage API tokens or Manage connected apps.

What they can do

A connected app or a token works as you:

• It reaches every organization you belong to, with the same project access and permissions you have. If your access changes, so does its access.
• It's either Read-only or Read and write. A read-only one can look but never change anything.
• What it posts appears under your name, with a small label saying how it got there: "via API" for a token, or "via" and the app's name for a connected app, such as "via Claude Code". That way nobody mistakes it for something you typed yourself.

Anyone can connect the CLI or compatible apps and create tokens for themselves, on any plan. Browser-approved CLI connections appear under Connected apps.

Connected apps

Each connected app shows its name, its access (Read-only or Read and write), when you connected it, and when it was last used.

To cut one off, click Disconnect. Its access ends right away: the app's next request is refused. It moves to a Disconnected list below, and to use it again you connect it again from the app.

Disconnecting doesn't undo what the app already did, and it doesn't delete copies of your data the app or its AI providers already received. To connect a new app, see Connect ChatGPT and AI Apps to Thicket with MCP.

Personal access tokens

A personal access token is a password-like key a script or tool sends with each request to the Thicket API. To create one:

1. Under Token name, name it after what will use it, such as "Reporting script"
2. Choose its Access: Read-only (the default) or Read and write
3. Choose when it Expires: Never, In 30 days, In 90 days, or In a year
4. Click Create token
5. Copy the token from the Copy your new token window and store it somewhere safe, then click Done

Thicket shows a token only once. If you lose it, revoke it and create a new one. Tokens start with thicket_pat_, and a tool sends one in an Authorization: Bearer header.

Each active token is listed with its name, its access, the start of the token, when it was created, when it was last used, and when it expires. Click Revoke to stop it: requests that use it stop working immediately. Revoked tokens stay listed under Revoked tokens for your records.

A few rules keep tokens safe:

• You can create and revoke tokens only while signed in to the web app. A token can't be used to create another token.
• A read-only token can only read. Anything that would change something is refused.
• Each token can make 50 requests every 10 seconds. A tool that goes faster is asked to wait and retry.

Current CLI versions connect through OAuth and appear under Connected apps. Older CLI versions created personal tokens named after the computer; those tokens remain valid until revoked. Update the CLI and sign in again to use OAuth, then revoke the old token when you no longer need it.

Keeping your account safe

• Treat a token like a password. Keep it in a password manager or your tool's secret settings, never in a project post, a chat, or a shared document.
• Give each tool its own token, choose Read-only unless it needs to make changes, and set an expiry when you can.
• Revoke tokens and disconnect apps you no longer use.
• Changing your password signs out your other browsers, but it doesn't revoke tokens or disconnect apps. Do that here.

If you find a token or connection you don't recognize, revoke or disconnect it, change your password, and turn on two-factor authentication.