API tokens

API tokens authenticate requests made on your behalf by something other than your own signed-in browser — an MCP-connected agent, a script, or any external tool. They're account-scoped, not tied to a single drain, and can be created or revoked at any time from your avatar menu in the sidebar → API tokens.

Authenticating requests

Send the token as a bearer token on the Authorization header:

Authorization: Bearer <your-token>

Attribution

Entries created with a token are never indistinguishable from who wrote them — they carry avia <token name> attribution visible in the entry's history, the same way a human-authored entry shows who wrote and last edited it.

Revoking access

Revoking a token immediately invalidates it for all future requests. Entries it already created are untouched — attribution is a permanent record, not a live reference to the token.

For the full list of what an authenticated agent can do, seeConnecting an agent.