API Tokens
API tokens are project-scoped bearer credentials for CI pipelines, scripts, and the MCP server. They are separate from the project's DSN, which sends telemetry through the Sentry ingest protocol.
Creating a token
Open Settings > Tokens > Create token. This requires manage_projects.
| Field | Description |
|---|---|
| Project | The project this token can access. |
| Token name | A label such as CI sourcemap upload. |
| Allow writes (MCP actions, issue updates) | Off by default; enable only when the integration needs supported mutations. |
The value is shown once. Copy it before dismissing the form and keep writable tokens out of client-side code.
Read vs write access
Read-only tokens can query the project's telemetry through supported API and MCP endpoints. Writable tokens additionally allow:
| Operation | Supported access |
|---|---|
| Update issue status or assignee | Project issue API and MCP update_issue. |
| Bulk issue updates | MCP bulk_update_issues. The global bulk REST endpoint requires a permitted user session. |
| Merge or unmerge issues | Project issue API. |
| Upload or delete source maps | Project source-map API. |
| Start a project setup check | Project setup-check API. |
| Create an alert rule | MCP create_alert_rule, scoped to the token's project. |
Write access does not grant instance administration. Global alert-management REST endpoints, user management, project administration, and the instance ingestion-status endpoint require a user session with the appropriate permission. Creating an alert through MCP does not grant access to POST /api/alert-rules or its update/delete/test endpoints.
Using a token
Send the token in the request header:
Authorization: Bearer tindra_your_token_here
For example, a writable token can upload a source map to POST /api/projects/{projectSlug}/sourcemaps. Send multipart fields release, url (the generated JavaScript file URL), and file (the map). The project slug must belong to the token; changing a URL or query parameter cannot expand its scope.
Project tokens authenticate independently of user sessions and do not require an interactive MFA code. A user's password change or reset does not rotate these tokens.
STATS_API_KEY is a different, operator-level credential for /api/stats and /metrics. A project token does not replace it. See Configuration.
MCP server
Use a project token to authenticate POST /mcp. The tools update_issue, bulk_update_issues, and create_alert_rule require write access; read tools work with read-only tokens. See MCP Server for connection examples.
Revoking a token
In Settings > Tokens, open the token's menu and revoke it. Revoked or expired tokens are rejected with 401. If a token is compromised, revoke it before creating a replacement.