# Mint and revoke your MCP token

> How to create, rotate, and revoke the token that lets an AI agent read your store's protection status.
> Category: Agent access (MCP)
> Canonical: https://rabbot.ai/docs/mcp/mint-and-revoke-tokens/
> Updated: 2026-08-24

---

## Where the token lives

Open **Settings** in your installed app and find the **Agent access (MCP)** card. It has two buttons: **Mint token** and **Revoke token**. This is the only place a token is created or removed.

## Minting a token

Choose **Mint token**. The token appears once, on screen, and Rabbot never shows it again after that: copy it straight away and store it somewhere safe. Rabbot keeps only a hash of it, never the raw value, so nobody at Rabbot can read it back to you if you lose it.

If you do lose it, mint another. That is the whole recovery path: there is no "reveal token" option to fall back on.

## Rotating a token

Minting a new token retires the previous one immediately. There is no separate rotate button because you do not need one: mint again, update whichever client was using the old token, and the old one stops working as soon as the new one appears. Do this on a schedule if you want, or straight away if you suspect a token has leaked.

## Revoking a token

Choose **Revoke token** to cut off agent access without minting a replacement. This is a red outline button on the same card, deliberately styled apart from Mint so the two are hard to confuse.

Revoking touches nothing else. The token is separate from how you sign in to Shopify and shares no code path with your store's Shopify connection, so revoking it costs you nothing beyond the agent losing access. Your monitoring, alerts, and dashboard keep running exactly as before.

## Rate limits

Each token is capped at five requests a second, with a burst allowance of ten. That is enough for normal back-and-forth with an agent. A misbehaving client sending far more than that gets throttled before it reaches your store's data, so a runaway agent cannot overload it.

## If something looks wrong

If a request from your agent fails with an authorisation error, revoke the token first and mint a fresh one before troubleshooting anything else on the client side.