# Access Tokens

Source: https://docs.qualflare.com/docs/api/access-tokens · Last updated: 2026-10-27

Create, use and revoke Qualflare project access tokens (qfp_), the API keys of the qf CLI, scripts and MCP agents. New tokens expire after at most 90 days.

In Qualflare, an **access token** is a project-scoped API key that the qf CLI, scripts, integrations and [AI coding agents over MCP](https://docs.qualflare.com/docs/api/mcp) authenticate with; a new token starts with `qfp_` and expires after 7, 30, 60 or 90 days.

Every token can read the project and upload test results. Only a token created with **Allow writes** can also create and edit test cases, steps, defects and suite coverage over the API and MCP, and run imports. You can't change this later: create a new token and revoke the old one (or ask a Maintainer or Owner to).

A token never has more access than its creator. Qualflare checks the creator's [current project role](https://docs.qualflare.com/docs/administration/roles-permissions) on every request: reading needs **Viewer** or higher, and uploading or writing needs **Editor** or higher. Lowering or removing that role takes effect immediately, and a token stops working if its creator's account is deactivated.

|                         |                                                                      |
| ----------------------- | -------------------------------------------------------------------- |
| **Where**               | **Project Settings** > **Access Tokens**                             |
| **Scope**               | One project                                                          |
| **Format**              | New tokens start with `qfp_`                                         |
| **Expiration**          | 7, 30, 60 or 90 days (default 30)                                    |
| **Access**              | **Read & upload**, or **Read, upload & write** with **Allow writes** |
| **Create**              | (requires the Editor role or higher in the project)                  |
| **Revoke** (in the app) | (requires the Maintainer role or higher in the project)              |
| **Limit**               | 20 tokens per project that aren't revoked                            |
| **Used by**             | The qf CLI, scripts and integrations, and MCP clients                |

## Accessing tokens

Go to **Project Settings** > **Access Tokens** to manage your project's tokens.

*Figure: Each token shows its access level, its owner, and how long it has left.*

## Creating a token

You need the **Editor** role or higher to create a token.

1. Click **Create Access Token**
2. Enter a **Name** of 3 to 100 characters (e.g., "GitHub Actions", "Local Dev")
3. Choose an **Expiration**: 7, 30, 60 or 90 days (default 30)
4. Tick **Allow writes** only if the token must change data. Uploads don't need it.
5. Click **Create**, and confirm it's you if asked
6. **Copy the token immediately** — it is only shown once after creation

*Figure: Pick when the token expires, and tick Allow writes only if the token must change data.*

> **Warning:** Access tokens are only displayed once at creation. Store it securely in a password manager or as an encrypted CI/CD secret immediately.

*Figure: Qualflare shows a new token only once, so copy it before you leave the page.*

A project can have up to 20 tokens that aren't revoked, and expired tokens count until they're revoked. [A new project](https://docs.qualflare.com/docs/administration/projects) may already have a **Default** token with **Read & upload** access that expires after 30 days.

## Token fields

| Column           | Description                                                                                                                  |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Name**         | The token's name and the start of its value                                                                                  |
| **Access**       | **Read & upload**, or **Read, upload & write** with Allow writes                                                             |
| **Owner**        | The person who created the token                                                                                             |
| **Date Created** | Date the token was created                                                                                                   |
| **Expires**      | Days left and the date. **Expires soon** in the last 7 days (except 7-day tokens), then **Expired**: the token stops working |

Maintainers and Owners see every token in the project. Others see only their own.

## Revoking a token

Open the **⋯** menu on the token's row, choose **Revoke**, then confirm with **Revoke token**. In the app, only Maintainers and Owners can revoke. For an Editor, **Revoke** is disabled, even on a token they created, with the note "Ask a maintainer or owner to revoke this token." Revoking is immediate and can't be undone: the CLI, CI pipelines, scripts and agents that use the token stop working. To restore access, create a new token and update it wherever the old one was used.

*Figure: In the app, only Maintainers and Owners can revoke a token.*

Qualflare emails a token's creator 7 days before it expires (not for 7-day tokens).

## Using tokens with the CLI

[Install the CLI](https://docs.qualflare.com/docs/cli/installation) first.

Save the token under a local identifier with `qf login`, which asks for it at a hidden prompt. Then prefix your commands with that identifier:

```bash
qf login myapp
qf myapp collect results.xml
```

For the formats `collect` uploads, see [Collect Test Results](https://docs.qualflare.com/docs/cli/collect).

In CI, expose the token secret as the `QF_TOKEN` environment variable. `qf login` reads it, and `--force` replaces an existing identifier without asking:

```bash
qf login ci --force
qf ci collect test-results/*.xml
```

Don't pass the token as an argument: shell history and the process list keep it.

See [CLI Configuration](https://docs.qualflare.com/docs/cli/authentication) for details on the identifier model, credentials file location, and available options.

## Using tokens with a coding agent

The same token connects an AI coding agent to Qualflare over MCP — no separate key. An agent that creates or edits data needs a token created with **Allow writes**.

In bash or zsh, run `read -rs QF_TOKEN`, paste the token and press Enter. Nothing is shown, and the token stays out of your shell history. Then add the server to Claude Code:

```bash
claude mcp add --transport http qualflare https://api.qualflare.com/mcp \
  --header "Authorization: Bearer $QF_TOKEN"
```

Claude Code stores the header, token included, in its own MCP configuration: treat that file like the token.

See [Connect a coding agent](https://docs.qualflare.com/docs/api/mcp) for other clients, and
[MCP Server](https://docs.qualflare.com/docs/api/mcp-reference) for every tool an agent can call.

## Why a token stops working

* It expired.
* Someone revoked it.
* Its creator's role was lowered or removed ([roles](https://docs.qualflare.com/docs/administration/roles-permissions)).
* Its creator signed out everywhere, reset their password or locked their account ([Account security](https://docs.qualflare.com/docs/administration/account-security)).
* The workspace turned on a 2FA requirement ([Workspace Settings](https://docs.qualflare.com/docs/administration/workspaces)) or an SSO requirement ([SSO & SCIM](https://docs.qualflare.com/docs/administration/sso)).
* Its creator's account was deactivated or deleted.

Requests with such a token get `401` with `invalid or expired access token`; a creator whose role is too low gets `403` with `no project access`; a write with a read-only token is refused with the read-only error quoted in [MCP server reference](https://docs.qualflare.com/docs/api/mcp-reference#authentication-and-permissions). See [Troubleshooting](https://docs.qualflare.com/docs/cli/troubleshooting#api-key-not-working).

## Security best practices

* **Use one token per environment** — separate tokens for local dev, staging, and production
* **Store in CI secrets** — never commit tokens to source code
* **Rotate before expiry** — when the reminder email or **Expires soon** appears, create a new token, update your CI secret, then revoke the old one (or ask a Maintainer or Owner to)
* **Leave Allow writes off** — unless the token must change data
* **Revoke unused tokens** — clean up tokens for tools or environments no longer in use
* **Use descriptive names** — "GitHub Actions — Production" is clearer than "key1"

To store a token as a CI secret, see [CI/CD](https://docs.qualflare.com/docs/cli/ci-cd) and the [Open Source CI setup](https://docs.qualflare.com/docs/open-source/ci-setup).

## Related

* **Guides:** [Connect a coding agent (MCP)](https://docs.qualflare.com/docs/api/mcp) · [CI/CD Integration](https://docs.qualflare.com/docs/cli/ci-cd) · [GitHub Action](https://docs.qualflare.com/docs/cli/ci-cd/github-actions)
* **Reference:** [MCP server reference](https://docs.qualflare.com/docs/api/mcp-reference) · [Project Settings Reference](https://docs.qualflare.com/docs/administration/project-settings)
* **CLI/API:** [CLI Configuration](https://docs.qualflare.com/docs/cli/configuration)