Account Settings → AI Integration (MCP) is the account-level control center for Taskavel’s AI connections. It displays the server URL for your installation, OAuth-connected agents, and personal access tokens. These are separate types of credentials with separate revocation controls.
OAuth connections
OAuth is used by clients that open a Taskavel approval page during setup, such as ChatGPT and Claude Desktop. Once approved, Taskavel records the connected client under the connected-agent list. The connection operates as the user who completed approval; it still follows that user’s projects, memberships, and role limits.
Review this list when you change devices, stop using an assistant, or suspect a connection was created with the wrong account. Select Disconnect for the relevant client to revoke its OAuth connection. If you want to use that client again later, reconnect it through the client’s normal OAuth flow.
Disconnecting a client is not a reset for every integration. It affects only that OAuth connection. A separate command-line client can continue to work if it uses a valid personal access token, and it must be revoked from the token list instead.
Personal access tokens
Create a PAT when a local or command-line MCP client needs an HTTP Bearer credential. Choose a recognizable name before creating it so the list later tells you exactly which installation owns the token. The token value is provided only at creation, so store it in the client’s secret manager or an environment variable rather than in a shared document.
The server grants PATs the mcp:full scope. That scope supports the MCP surface, while your Taskavel account and project roles remain the effective boundary for data and write actions. A PAT should never be treated as a team-wide configuration value. Create individual, named tokens for different people, clients, or machines.
To stop a CLI client, revoke the matching token. A revoked token cannot be restored; create a new one only if the client still needs access. Update the new value in the client’s secret configuration without exposing it in version control.
Review routine
Periodically compare the connected-agent and token lists with the clients you still use. Remove stale OAuth connections and tokens independently. After a lost device or accidental token exposure, revoke first, then create a replacement only where required. This minimizes the time a credential can be used and avoids disrupting unrelated assistants.
See Connect to Taskavel MCP for choosing a method, and security and revocation for safe credential handling.