Personal access tokens
Advanced direct-bearer setup for the DropHaul MCP server.
Personal access tokens are for deliberate direct-bearer setups only. The custom OAuth, Claude package, and Codex package paths contain no PAT.
Create a token
- Sign in at DropHaul API Tokens as an owner or admin. No other role can mint or revoke tokens.
- Open Settings → API Tokens and choose Create token.
- Choose kind
operator(a human's own client; default 90 days, maximum 365 days). Theagentkind is for automated testing against non-production deployments only. Never issue an agent PAT in production. - Select the smallest set of scopes that covers your workflow. All four bundled Claude Code / Codex skills work with read-only scopes.
- Create it and copy the value. It starts with
dh_pat_and is shown once. DropHaul stores only a SHA-256 hash plus the last four characters.
export DROPHAUL_MCP_KEY="dh_pat_…"Never commit the token or paste it into shared configuration.
Scopes
Scopes are always intersected with the token owner's live DropHaul permissions at request time. A scope can narrow what a token may do; it can never widen it. Revoking the user's role or org membership invalidates the token on its next request.
| Read scopes | Write scopes |
|---|---|
records:read, jobs:read, routes:read, customers:read, units:read, sites:read, invoices:read, quotes:read, org:read, self:read, supplies:read | jobs:write, jobs:dispatch, routes:write, routes:optimize, customers:write, units:write, sites:write, invoices:write, quotes:write, self:write, supplies:write |
See Security for how these scopes gate writes and approvals.
Rotate or revoke
Rotate a PAT by creating the replacement, validating it with whoami,
updating the client, and revoking the old token. Do not leave both active
longer than the handoff. Revocation takes effect on the next request.
Per-client setup with a token
- Claude Code plugin → Advanced direct PAT setup
- Codex → Advanced PAT setup
- Installation → Advanced: personal access token