Gateway Tokens
Gateway tokens (cn-live-*) provide scoped, time-limited fallback access to the Clevername API for raw HTTP clients, automation, and older MCP clients that do not support OAuth.
What are gateway tokens?
Gateway tokens are prefixed with cn-live- in production (cn-dev- on staging) and provide scoped access to the Clevername API. Older tokens with the legacy cnk_ prefix are still accepted but no longer issued. Unlike your Supabase JWT (which grants full account access), gateway tokens can be restricted to specific tools, given a budget cap, and expire after at most 90 days.
When to use them
Use gateway tokens when you need raw HTTP access, server-side automation, or support for an MCP client that does not yet implement OAuth browser login. For Claude Code, VS Code, Cursor, and other modern MCP clients, OAuth is the recommended default.
Token properties
| Property | Description |
|---|---|
| Tool Allowlist | Restrict which MCP tools the token can invoke. Empty = all tools allowed. |
| Budget Limit | Maximum spend (in USD) for this token. Requests are rejected when exceeded. |
| Expiry | Up to 90 days after creation. You can set a shorter expiry when creating the token, and an org token policy can lower the maximum. |
| Label | A human-readable name to identify the token's purpose. |
Open Keys settings
Go to Dashboard → Settings → Keys. You will see your existing tokens with their labels, creation dates, and expiry dates.
Create a new token
Click Create Token. You will need to verify with MFA (enter your TOTP code) before the token is generated.
Configure scope and budget
After MFA verification, configure the token:
- Label — a descriptive name (e.g., “CI/CD pipeline”, “Slack bot”)
- Tool Allowlist — select specific tools, or leave empty to allow all
- Budget Limit — maximum spend in USD (optional, enforced against estimated provider cost)
- Expiry — optional; defaults to the 90-day maximum
Copy and store the token
The token is displayed once after creation. Copy it immediately and store it in a secure location (environment variable, secret manager, etc.). The token cannot be retrieved after you close the dialog.
cn-live- followed by a random string. Example: cn-live-a1b2c3d4e5f6...Revoke a token
To revoke a token, click the delete icon next to it in the Keys list. MFA verification is required. Once revoked, any requests using that token will immediately receive a 401 error.