API & MCP access
Personal tokens and MCP server URLs that you control. Programmatic access is a first-class citizen.
Personal API tokens
Generate scoped tokens from the app under Settings → API. Tokens can be scoped (read-only, collections-only) and rotated at any time.
MCP server URL
Every account exposes an MCP endpoint. Point any MCP-capable client at your server URL to give it read (and, if you allow, write) access to your vault.
Security
- Treat tokens like passwords — store them in a secrets manager.
- Rotate tokens regularly; revoke ones you no longer use.
- Never commit tokens to source control.
Suspect a token leak? Revoke it immediately and contact security@omegavault.app.
Related
See Connected apps to audit which clients are actually using your vault.