Resource Tokens
Register external resource clients with an approver, Model Context, expiry settings, and narrow Connection permissions.
Resource Tokens register the BotDojo CLI or a custom MCP client with a controlled BotDojo resource and permission area. Open Advanced → Resource Tokens to review the resource, approver, approver status, policy count, and creation date.
Usually managed through client setup
You normally create a Resource Token while registering the BotDojo CLI or configuring a custom MCP client, then return here only to review its permission boundary, change authorization policy, or revoke it.
Creating a token requires at least one eligible non-agent approver user and one Model Context resource.
Resource Tokens and API keys
A Resource Token is similar to an API key because it starts from a credential that identifies a client, but it uses an OAuth-style lifecycle:
Resource Token registration
↓
Human authorization + permission boundary
↓
Short-lived access token + rotating refresh token
↓
BotDojo CLI or custom MCP client
- An API key is presented directly by the API client according to that key's project or Flow authorization.
- A Resource Token establishes a bounded registration. The client receives a short-lived access token and uses its refresh token to obtain replacements while the approval age and refresh-token lifetime remain valid.
- The selected Model Context and Connection permissions define the resources available through that registration. Refreshing credentials does not expand this permission area.
Token settings
| Setting | What it does |
|---|---|
| Name and icon | Identify the client in the Resource Tokens table. The name is display-only. |
| Approver User | Assigns the human user responsible for authorization. The table surfaces that user's current status. |
| Model Context | Selects the primary resource the client registers. |
| Max Authorization Age | Sets how long the human authorization can remain valid before the client must receive approval again. |
| Refresh Token TTL | Sets the maximum lifetime of the rotating refresh token before the client must register again. |
| Shared Connections | Grants only the Connection permissions the external client needs. |
| BotDojo Project Connection | Controls access to project-level BotDojo tools separately from shared Connections. |
Select Create Resource Token and save the settings. BotDojo displays the public token after creation. Copy it at that time and register it with:
bd_resource register <token>
Treat the registration token, access tokens, and refresh tokens as credentials. Do not place them in documentation, source control, or screenshots.
Changing the approver, Model Context, policy permissions, maximum authorization age, or refresh token TTL invalidates the current refresh token. Existing clients must register again. Delete Resource Token revokes the selected record; remove its saved credential from the client as well.