Skip to content

API tokens & AI assistants (Pro)

What it's for

The Management API lets scripts, RMM/PSA tooling, or an AI assistant (Claude, Gemini CLI) operate this fleet the same way you do in the admin UI — list and edit clients, connect or kill a tunnel, mint pairing tokens, and more. A token is scoped to exactly what you allow it to do.

How to use it

  1. Open API Tokens in the left nav.
  2. Click Create token, give it a name, and tick the scopes it needs. Leave scopes unticked for anything it shouldn't be able to do — a token can look without being able to touch, or touch only the things you tick.
  3. Optionally bind it to one customer — it then only ever sees that customer, never the rest of your fleet.
  4. Click Create. The full token is shown exactly once — copy it somewhere safe before leaving the page. If you lose it, revoke the token and mint a new one; it can't be shown again.

Connecting an AI assistant or automation tool

Same token as above, no separate setup — point Claude, Gemini, OpenAI, Mistral, or n8n at your backend using the token as its credential. See Connect an AI assistant or automation tool for exact setup steps per tool.

Once connected, you can ask an AI assistant things like "which clients haven't checked in this week" or "kill client 42's tunnel" — it does exactly what the token's scopes allow, nothing more.

Pitfalls

  • A token is a credential, not a person. Everything it does is logged under the token's name, not under whoever is typing the prompts. If three people share one AI-assistant token, the audit log can't tell them apart — mint one token per person if that distinction matters to you.
  • Start an AI-assistant token read-only. Grant clients:actions or a *:write scope only once you're comfortable letting it act, not just look.
  • configs:read is the one scope that can see a WireGuard private key. It's flagged separately for a reason — think twice before handing it to an AI assistant, since the config then transits that assistant's own infrastructure.
  • Revoking a token takes effect immediately — anything using it (script, RMM, AI assistant) stops working on its very next call.