curl --request POST \
--url https://api.gigstack.io/v2/users/me/mcp-tokens \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/mcp-tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/mcp-tokens"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"success": false,
"error": {
"code": "account_approval_required",
"message": "Prepare and confirm this credential action through an account approval"
},
"timestamp": 1700000000000
}Retired: Create a personal MCP token
Direct credential issuance is retired. Returns HTTP 403 account_approval_required without generating credentials. Prepare an action through POST /users/me/account-approvals with a persisted UUIDv4, then let the initiating person review and confirm in the authenticated browser. Existing list and revocation operations remain available.
curl --request POST \
--url https://api.gigstack.io/v2/users/me/mcp-tokens \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/mcp-tokens', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/mcp-tokens"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"success": false,
"error": {
"code": "account_approval_required",
"message": "Prepare and confirm this credential action through an account approval"
},
"timestamp": 1700000000000
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.