A personal access token (PAT) lets a tool act as you — an MCP client such as Claude Code, a script, curl — with your member rights in the projects you belong to. It is the person-shaped counterpart of a project token: a project token belongs to one project and carries the access tree it was minted with; a PAT belongs to you, names the projects it may act on, and in each of them has exactly the role and capabilities your membership gives you. A platform role is never carried by a token.
Getting one#
Create it in CRM & Studio under Profile › Personal access tokens (see Profile): a label, the projects (or All my projects), whether it may use Demo, and an expiry — 30, 90 or 365 days, or never. The token, in_ followed by 43 characters, is shown once. Treat it like a password. Managing tokens always needs a signed-in console session; a token cannot create, list or revoke tokens.
Sending it#
Every call to the console host https://inmake.dev takes the token in either header:
Authorization: Bearer in_…
access-token: in_…The console MCP server — https://inmake.dev/mcp#
The same drop-core MCP tools as the project endpoint https://core.inmake.dev/mcp, for several projects in one connection:
claude mcp add --transport http inmake https://inmake.dev/mcp --header "Authorization: Bearer in_…".mcp.json (Claude Code, Cursor, VS Code):
{"mcpServers": {"inmake": {"type": "http", "url": "https://inmake.dev/mcp", "headers": {"Authorization": "Bearer in_…"}}}}Then listStores lists the projects you can open, useStore {store, env} picks one — it stays the active project of the conversation — and every other tool runs on it (or pass store / env to aim one call elsewhere). Each call runs with your own member token for that project, so the project's activity feed shows your e-mail. The console-settings tools (readConsoleSettings, writeConsoleMenu, writeConsoleOverview) are here too: as a project manager you may change the pinned menu and the dashboard. Image generation is not offered on this endpoint.
The project endpoint core.inmake.dev/mcp keeps taking a project token plus the store header — one project per connection.
The API#
| Call | Credential | Answer |
|---|---|---|
GET /me |
PAT or session | who you are, and for a PAT its label, projects, Demo flag and expiry |
GET /me/stores |
PAT or session | {stores: [{sid, organization, role, manager, capabilities, demo, envs}]} — the projects you can open (for a PAT, only those it names) |
POST /me/stores/{project}/token {"env": "prod" | "demo"} |
PAT | {token, store, env, role, capabilities, scope, api} — your project token for that project, to use against https://core.inmake.dev/api like any project token. The same value on repeat calls until it is rotated |
DELETE /me/stores/{project}/token {"env": …} |
PAT | revokes it |
/api/{env}/** on inmake.dev |
PAT | the console's own API proxy, with the same member token |
curl -X POST https://inmake.dev/me/stores/mystore/token \
-H "access-token: in_…" -H "content-type: application/json" -d '{"env": "demo"}'A project token from the exchange can stop working when your access changes: your role in the project changes its rights in place, but a manager's Rotate API token on your membership, or the removal of a capability, replaces it — a call then answers 401; exchange again. Leaving the project, or revoking the PAT, revokes it.
What a token cannot do#
Anything that needs a console session: managing tokens, the AI assistant, the credits shop, store creation, deletion and transfer, spaces and their cloud, module packages, custom-domain mounts. Those answer 403 with reason: "session_required". A token is also refused for a project it does not name (store_not_in_token), for Demo when it was created without it (demo_not_in_token), and wherever your membership would be.
Lifetime#
A token works until it expires or is revoked (Profile › Personal access tokens). Revoking ends it at once, together with the project tokens it holds, and deletes it (a revoked token then answers 401 token_invalid, like an unknown one). An expired token stops working and its project tokens are revoked within a day, but it stays on the Profile until you Remove it. Signing out everywhere does not revoke tokens; a disabled or deleted account ends every one. The Profile shows each token's last use and IP.