Account tokens

An account token (prefix nf_at_) is the credential that authenticates the Notiflows developer surfaces: the CLI, the MCP server, the agent toolkit, and the Management API they all sit on top of.

Create one

Tokens are created in the dashboard, alongside Profile, Billing, and Team in your account settings.

1. Open Account tokens at https://app.notiflows.com/account-tokens.
2. Click New token and give it a descriptive name (e.g. CI/CD Pipeline, claude-mcp, github-ci).
3. Copy the secret immediately — it is shown once and cannot be retrieved again.

Scope

Account tokens are account-scoped: a single token can access every project in the account. There are no per-project tokens and no fine-grained scopes today — a token is broad, with full read/write access to everything the account owns.

You select the target project per request rather than per token:

• CLI — the --project flag, the NOTIFLOWS_PROJECT env var, or the project field in notiflows.json.
• MCP server — the project argument on each tool call (call list_projects to discover slugs).
• Management API — the project slug in the path (/projects/{project_slug}/…).

Lifecycle

Account tokens do not expire. From the dashboard you can:

• Rename a token.
• See its last-used time.
• Delete (revoke) a token.

There is no in-place rotation: rotate by creating a new token and deleting the old one. If a token ever leaks, revoke it immediately and issue a replacement.

Where it's used

The same token authorizes every developer surface — only the mechanism differs:

# CLI — login stores it at ~/.config/notiflows/credentials.json
notiflows login --token nf_at_xxx
# or non-interactively via env / flag
export NOTIFLOWS_TOKEN=nf_at_xxx
notiflows whoami --token nf_at_xxx

# MCP server — sent as an Authorization: Bearer header to the hosted endpoint
claude mcp add notiflows -- npx -y mcp-remote https://api.notiflows.com/mcp \
  --header "Authorization: Bearer nf_at_xxx"

// Agent toolkit — the accountToken option
import { createNotiflowsToolkit } from "@notiflows/agent-toolkit";

const toolkit = createNotiflowsToolkit({
  accountToken: process.env.NOTIFLOWS_TOKEN!, // nf_at_...
  project: "acme",
});

# Management API — Authorization: Bearer
curl https://api.notiflows.com/management/v1/whoami \
  -H "Authorization: Bearer nf_at_xxx"

Auditability

Actions taken with a token are attributed to it by name:

• Notiflow runs in the dashboard show "Triggered by <token name>".
• Notiflow version history records the token as the creator of a change.

Name tokens after the system that uses them (e.g. github-ci, claude-mcp) so the audit trail reads clearly.

Security

Treat an account token as a secret with full account write access:

• Store it in a secret manager or environment variable; never commit it to a repository.
• Scope it to one system and name it accordingly so a leak is easy to attribute and revoke.
• Revoke immediately on any suspected leak, then issue a replacement.

Related