Personal Access Tokens (PATs) let you connect any MCP client to FullEnrich without going through OAuth. They are made for clients where OAuth is not available or too heavy: scripts, CI pipelines, custom integrations....
If your client supports OAuth (claude.ai, ChatGPT), use the standard MCP connector instead - it handles authentication automatically. PATs are for everything else.
What is a Personal Access Token?
A PAT is a long-lived token in the format fep_... that you create yourself from your FullEnrich settings.
A few things to know:
It's personal. The token is tied to you and to the workspace where you created it. Any action performed with it is done as you, in that workspace.
It only works for MCP. A PAT gives access to the FullEnrich MCP server only. It cannot be used to call the REST API or log into the app.
You can have several. Create one token per client (for example "Claude Code" and "CI script"), each with its own name, so you can track and revoke them individually.
Create a token
Go to Settings => All Settings => Api Key & Tokens
Click Generate new token
Copy the token right away
⚠️ The token is shown only once. If you lose it, you can't retrieve it - just create a new one.
The token list shows each token's name, prefix, creation date & last used date.
Connect your client
Your PAT is used as a Bearer token on https://mcp.fullenrich.com/mcp.
Claude Code
bash
claude mcp add fullenrich https://mcp.fullenrich.com/mcp \ -t http \ -H "Authorization: Bearer fep_xxxxxxxx"
Cursor and other JSON-config clients
Add this to your mcp.json:
json
{ "mcpServers": { "fullenrich": { "url": "https://mcp.fullenrich.com/mcp", "headers": { "Authorization": "Bearer fep_xxxxxxxx" } } } }
Quick test with curl
bash
curl https://mcp.fullenrich.com/mcp \ -H "Authorization: Bearer fep_xxxxxxxx" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Note: the claude.ai web connector stays on OAuth - it doesn't support custom headers. PATs are meant for desktop, CLI, and script-based clients.
Oauth, API key or PAT?
Simple rule: if your client can do OAuth, use OAuth. Otherwise => PAT. The API key is unrelated to MCP: it's only for the public REST API.
Revoke a token
Revoke: click on the Trash icon next to the token in the list. It stops working immediately and disappears from the list. This is irreversible.
If a token was exposed (accidental commit, screen share...), revoke it immediately and create a new one. In the worst case, a revoked token may remain valid for up to 5 minutes due to caching - after that, it's fully blocked.
Best practices
One token per client. Don't reuse the same token in Claude Code and a CI script - that's what the name field is for.
Store tokens as secrets (environment variables, secret manager) - never in plain text in a repo.
Revoke any exposed token immediately, then create a new one.
Check the "Last used" column from time to time and revoke tokens you no longer use.