> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentpost.email/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate an API token and configure your MCP client to authenticate with AgentPost.

Every request to the AgentPost MCP server must include a valid API token. Tokens are scoped to your account — tools can only access mailboxes, emails, and domains that belong to you.

## Generate a token

Go to [**Settings → API Tokens**](/account/api-tokens) and create a new token. Copy it immediately — AgentPost does not display the token value again after creation.

<Warning>
  Treat your API token like a password. Anyone with your token can read and delete your mailboxes and emails.
</Warning>

## Configure your MCP client

Pass the token as a `Bearer` value in the `Authorization` header of your MCP client configuration:

```json theme={null}
{
  "mcpServers": {
    "agentpost": {
      "url": "https://<app-url>/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}
```

Replace `YOUR_TOKEN_HERE` with the token you copied from Settings, and `<app-url>` with your AgentPost instance URL.

## How authentication works

AgentPost validates the token on every request before executing any tool. All tool calls are automatically scoped to the authenticated user — your agent cannot access another user's mailboxes or emails, even if it knows an address or message ID.

## Authentication failures

If the token is missing, invalid, or revoked, the server returns an error and the tool call does not execute. Your agent should surface this as a configuration error rather than retrying.

<Note>
  Revoke a token any time from [**Settings → API Tokens**](/account/api-tokens). Revoked tokens fail immediately on the next request.
</Note>

## Rate limit

The MCP server allows **60 requests per minute per token**. Requests beyond this limit are rejected until the window resets. If your agent needs to poll for email, use `WaitForEmail` instead — it streams progress server-side and counts as a single request regardless of wait duration.