Access tokens

Developer tools like Claude Code and Cursor can connect using an access token instead of OAuth. You create a token once and keep it in your tool's config until you revoke it or it expires.

Creating a token

1. On Settings → AI Assistant (MCP), click New token.
2. Give it a name (e.g. "Claude Code — Anna's laptop"). Include the person and machine so you can recognize it later.
3. Optionally set an expiry date. Without one, the token stays valid until you revoke it.
4. Click Create.
5. Copy the token immediately — it is shown exactly once. If you lose it, revoke it and create a new one.

The token starts with gmcp_ and is followed by random characters. Store it securely (e.g. in a password manager or your tool's native credential storage).

Using the token in your tool

Send the token as a bearer token:

Authorization: Bearer gmcp_...

Gurita also accepts it in an x-api-key: gmcp_... header, for clients that can't set Authorization.

Claude Code

The Gurita settings page shows this command ready-made — copy it from there, or fill in your address and token:

claude mcp add --transport http gurita https://YOUR-DOMAIN/api/mcp --header "Authorization: Bearer gmcp_YOUR-TOKEN-HERE"

Cursor

Edit ~/.cursor/mcp.json and add a section for Gurita (create the file if it doesn't exist):

{
  "mcpServers": {
    "gurita": {
      "url": "https://YOUR-DOMAIN/api/mcp",
      "headers": {
        "Authorization": "Bearer gmcp_YOUR-TOKEN-HERE"
      }
    }
  }
}

Restart Cursor after saving.

Other tools

Any MCP client that supports the Streamable HTTP transport and custom headers works. Point it at https://YOUR-DOMAIN/api/mcp and add the Authorization header above. Check your tool's MCP documentation for where headers go.

curl (for testing)

To test the connection with curl, initialize and list tools:

curl -X POST https://YOUR-DOMAIN/api/mcp \
  -H "Authorization: Bearer gmcp_YOUR-TOKEN-HERE" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {
        "name": "test-client",
        "version": "1.0.0"
      }
    }
  }'

Then list tools:

curl -X POST https://YOUR-DOMAIN/api/mcp \
  -H "Authorization: Bearer gmcp_YOUR-TOKEN-HERE" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/list",
    "params": {}
  }'

For current examples and syntax details for your specific tool, see the tool's MCP documentation.

Token status and expiry

On Settings → AI Assistant (MCP), you can see each token's:

Column	Meaning
Name	The label you gave it or the client's name (for OAuth tokens).
Token	The first 8 characters after the prefix — enough to recognize it.
Last used	When an assistant last connected with it. Useful for spotting unused or unexpected access.
Status	active, expired, or revoked.

A token becomes expired on the expiry date you set. Tokens created by the Claude or ChatGPT sign-in expire after 180 days.

Revoking a token

Click revoke next to the token to revoke it immediately. Revoking cannot be undone — the tool simply stops working. Create a new token if you need to reconnect.

Best practices

• Create one token per person and tool rather than sharing one token. That way you can see who uses what and revoke a single connection without affecting others.
• Name tokens clearly so you know which person and machine they belong to.
• Revoke unused tokens to reduce your attack surface.
• If a token leaks, revoke it immediately from Settings → AI Assistant (MCP).

What the token can access

A token acts as the user who created it. If that user has the Bookings permission, the token can run booking tools. If they lack the Customers permission, customer lookups fail. The admin's data-access policy (tool groups) applies to all tokens equally — a switched-off tool group affects both OAuth and token-based clients.