> ## Documentation Index
> Fetch the complete documentation index at: https://docs.judt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Give an agent access to a single App

> Create an App token and connect your agent to one App.

When you give an external coding agent access to Judt, you can scope its credential to **one specific App**. An App token lets the agent edit files, run commands, preview, commit, and deploy that App without seeing or modifying any other App in your organization.

## Choose how to connect the agent

| Goal | Credential to use |
| - | - |
| Restrict the agent to **one App** | Create an **App token** with `POST /api/tokens` and pass it to the MCP server or the REST API. It works for up to 24 hours. |
| Let the agent create new Apps and manage **all Apps** in your organization | Connect with **OAuth** (browser or device sign-in) or an **All apps API key**. See [Authentication](https://docs.judt.ai/manage/authentication.md). |

## Step 1: Create an App token

**1. Make sure the App exists**

In the [Judt dashboard](https://judt.ai/apps), select the App that the agent will work on, or click **New App** to create it first.

**2. Get an organization-wide API key**

Go to [API keys](https://judt.ai/api-keys) and click **Create key**. Set a name and an expiration time, click **Create key**, and copy the key (`judt_...`). Keep this key for yourself. It reaches all Apps in the organization.

Store the key in an environment variable so it does not appear in your shell history or source code:

```bash theme={null}
read -rs JUDT_ORG_KEY && export JUDT_ORG_KEY
```

**3. Create the App token**

Call `POST /api/tokens` with the ID of the App. `expires_in` is in seconds, from `60` to `86400` (24 hours). The default is `3600`.

```bash theme={null}
curl -X POST https://api.judt.ai/api/tokens \
  -H "Authorization: Bearer $JUDT_ORG_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"Claude Code, Customer Portal\", \"app_id\": \"$APP_ID\", \"expires_in\": 86400}"
```

The `token` value in the response is the App token (`judt_...`). The response is the only place that shows it.

**4. Give the token to the agent**

Store the token in the environment of the agent:

```bash theme={null}
read -rs JUDT_API_KEY && export JUDT_API_KEY
```

## What an App token can and cannot do

An App token acts with your organization role (`owner`, `admin`, or `member`) on the selected App only:

* **Allowed**: Read the App (`GET /api/apps` returns only that App), read and write files, run commands, inspect Git status, create and restore commits, create preview links, and (if your role is `owner` or `admin`) manage Secrets and publish deployments for that App.
* **Blocked**:
  * `POST /api/apps` and `POST /api/tokens` return `403 app_scoped_token`.
  * Any request to `/api/apps/{other_id}` or `/api/apps/{other_id}/*` returns `404 not_found`.

> [!TIP]
>
> If you want an agent to edit and test code in the sandbox without being able to deploy to production, delete the App, or change Secrets, create the App token with an API key from an account that has the `member` role.

## Step 2: Connect the agent

You can connect the agent through the **MCP server** or through the **REST API**.

> [tab] MCP server (recommended)
>
> Add the Judt MCP server (`https://api.judt.ai/mcp`) to your client with the App token in the `Authorization` header.
>
> For Claude Code:
>
> ```bash theme={null}
> claude mcp add --transport http judt https://api.judt.ai/mcp \
>   --header "Authorization: Bearer $JUDT_API_KEY"
> ```
>
> For Codex, Cursor, and VS Code configuration files, see [Configure your MCP client](https://docs.judt.ai/connect-to-mcp.md#configure-your-mcp-client).
>
> Then give the agent its task:
>
> ```text theme={null}
> You manage my Judt App through the Judt MCP server.
> 1. Call list_apps to find the App you have access to.
> 2. Read wrangler.json and the source files with list_files and read_file.
> 3. Make the requested changes with write_file and test them with create_preview.
> 4. Commit your changes with create_commit.
> ```

> [tab] REST API / curl
>
> If your agent runs shell commands instead of MCP tools, start it in a shell where `JUDT_API_KEY` is exported and instruct it to read `https://judt.ai/llms.txt` or `https://api.judt.ai/api/openapi.json`:
>
> ```text theme={null}
> You manage a Judt App with the Judt REST API at https://api.judt.ai.
> Authenticate every request with the header: Authorization: Bearer $JUDT_API_KEY
> Read https://api.judt.ai/api/openapi.json for all endpoints and schemas.
> Start by calling GET https://api.judt.ai/api/apps to get the App ID.
> ```

## Revoke access when finished

An App token stops working when it expires. To stop it earlier, go to [API keys](https://judt.ai/api-keys), open the menu of the token, and click **Revoke**. Any future request with that token immediately returns `401 unauthenticated`.

## Next steps

* Learn about OAuth sign-in and organization roles in [Authentication](https://docs.judt.ai/manage/authentication.md).
* See all MCP tools in [Available MCP tools](https://docs.judt.ai/connect-to-mcp.md#available-mcp-tools).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.