Personal Access Tokens

A Personal Access Token (PAT) is the credential an AI client uses to authenticate against Waafir's MCP servers. Every request to a Waafir MCP server must carry a valid PAT — there is no anonymous access, and an ordinary logged-in browser session is not accepted on this surface (a session-authenticated request is rejected). A PAT acts as you, within your organization, bounded by the scope and data rooms you choose when you issue it.

Where to issue a token

Open Add-ons → Connect. The page has three parts: a form to issue a new token, the list of your existing tokens (with a revoke action), and ready-to-use configuration snippets for connecting a client.

To issue a token, fill in the form:

• Name — a human-readable label so you can recognise the token later (for example, "Claude Desktop – laptop"). Required.
• Scope — what the token is allowed to do. See below.
• Data room scope — leave All data rooms checked to let the token reach every data room you can access, or uncheck it and select specific data rooms to restrict the token to just those.
• Expiry — an optional date after which the token stops working.

Scopes

A token carries one of three scopes, in increasing order of authority:

Scope is cumulative — a higher scope includes everything below it. The tool reference for each server states the minimum scope each tool requires.

Who can issue each scope

A token can never carry more authority than the person who issues it:

• read and write can be issued by any active member of your organization.
• admin can only be issued by an organization owner or admin. If you are not an owner or admin, the admin option does not appear in the scope selector.
• Investors (and other non-deal-team roles) cannot issue tokens at all.

Beyond issuance, the admin permission tools apply a second ceiling at call time: the token's owner must themselves be an admin or manager in the organization for a permission grant to succeed. A token's scope is the token's ceiling; the owner's role is the person's ceiling, and an admin action has to clear both — exactly the rule the product UI applies. There is no looser path through MCP than through the product.

Restricting a token to specific data rooms

By default a token can reach every data room its owner can access. Unchecking All data rooms and selecting specific rooms restricts the token to that allow-list: any tool call referencing a data room outside the list is rejected, and a scoped token does not even see the names of data rooms it cannot open. Use this to hand an AI client access to one deal without exposing the rest of your portfolio.

Expiry

Setting an expiry date causes the token to stop working after that date — a request with an expired token is rejected exactly as a revoked one is. Expiry is optional; leave it blank for a token that lasts until you revoke it. A good practice is to set a short expiry on tokens you issue for a one-off task.

The one-time reveal

When you issue a token, the raw value — it begins with waafir_pat_ — is shown exactly once, immediately after creation. Waafir never stores the raw token, only a one-way hash of it, so it cannot be retrieved or shown again.

• Copy it now and paste it straight into your client's configuration. The reveal panel has a copy button.
• If you lose it, you cannot recover it — revoke that token and issue a new one.
• Treat it like a password: it grants its scope to anyone who holds it.

After the reveal, the token list only ever shows a short non-secret prefix (for example waafir_pat_ab12…) so you can tell your tokens apart without the secret being recoverable.

Revoking a token

In the token list on Add-ons → Connect, use the Revoke action next to any token. Revocation is immediate — the next request that uses the token is rejected. Revoke a token the moment a device is lost, a contractor leaves, or you simply no longer need the access. Revoked tokens remain visible in the list (marked revoked) so the record of what existed is preserved; they can never be reactivated.

Next: set up your client with the token you just issued.