Gateway Tokens
Gateway tokens (cnk_*) provide scoped, time-limited fallback access to the Clevername API for raw HTTP clients, automation, and older MCP clients that do not support OAuth.
What are gateway tokens?
Gateway tokens are prefixed with cnk_ and provide scoped access to the Clevername API. Unlike your Supabase JWT (which grants full account access), gateway tokens can be restricted to specific tools, given a budget cap, and automatically expire after 90 days.
When to use them
Use gateway tokens when you need raw HTTP access, server-side automation, or support for an MCP client that does not yet implement OAuth browser login. For Claude Code, VS Code, Cursor, and other modern MCP clients, OAuth is the recommended default.
Token properties
| Property | Description |
|---|---|
| Tool Allowlist | Restrict which MCP tools the token can invoke. Empty = all tools allowed. |
| Budget Limit | Maximum spend (in USD) for this token. Requests are rejected when exceeded. |
| Expiry | Tokens expire 90 days after creation. Non-configurable. |
| Label | A human-readable name to identify the token's purpose. |
Open API Keys settings
Go to Dashboard → Settings → API Keys. You will see your existing tokens with their labels, creation dates, and expiry dates.
Create a new token
Click Create Token. You will need to verify with MFA (enter your TOTP code) before the token is generated.
Configure scope and budget
After MFA verification, configure the token:
- Label — a descriptive name (e.g., “CI/CD pipeline”, “Slack bot”)
- Tool Allowlist — select specific tools, or leave empty to allow all
- Budget Limit — maximum spend in USD (optional, enforced against estimated provider cost)
Copy and store the token
The token is displayed once after creation. Copy it immediately and store it in a secure location (environment variable, secret manager, etc.). The token cannot be retrieved after you close the dialog.
cnk_ followed by a random string. Example: cnk_a1b2c3d4e5f6...Revoke a token
To revoke a token, click the delete icon next to it in the API Keys list. MFA verification is required. Once revoked, any requests using that token will immediately receive a 401 error.