Use a personal access token (PAT) when an MCP client cannot use Taskavel’s browser-based OAuth flow. This is the usual option for command-line tools and local agent runtimes. A PAT authorizes the client as your Taskavel user, so it has the same practical importance as another credential for your account.
Create a token for one client or machine
Open Account Settings → AI Integration (MCP) in Taskavel and create a personal access token. Give it a name that explains where it is used, such as codex-work-laptop or claude-code-ci-runner. Taskavel shows a newly created token value once. Copy it directly into the intended secret storage; it cannot be retrieved from the token list later.
The token grants the mcp:full scope. It does not turn the client into an administrator: the authenticated user’s project membership and Taskavel role checks still apply. Keep one token per installation whenever possible. That lets you revoke a lost machine or retired client without interrupting another integration.
Configure the endpoint and Bearer credential
The Taskavel production endpoint is:
https://taskavel.com/mcp/taskavel
Your MCP client needs this URL and an HTTP Authorization header in the form Bearer <token>. The exact configuration syntax depends on the client. Store the token in an environment variable or the client’s encrypted secret mechanism, then reference it from the configuration. Do not place the raw value in a repository, shell history, project file, support ticket, or screenshot.
For a self-hosted instance, use the endpoint displayed by its AI Integration page. A copied URL from that page prevents accidental use of an example hostname or a local development URL.
Test with a read-only request
After saving the configuration, start a new client session and ask it to list your Taskavel projects. If authentication works but expected projects are absent, the token may belong to the wrong Taskavel account or that account may not be a member of the project. Resolve that before attempting a write operation.
Then test a focused read such as task details or upcoming deadlines. Only after confirming the account and data should you allow mutations. Explicit prompts reduce accidental scope: name the project, task, target column, or intended comment rather than asking the client to make broad changes.
Replace or revoke a token
Return to Account Settings → AI Integration (MCP) to revoke a token. Revocation is immediate for that credential; create a replacement token and update the client configuration when access should continue. OAuth connections are listed separately and must be disconnected separately. See security and revocation for response steps after suspected exposure.