Create a service account token
Create a service account and generate the bearer token that an AI tool sends with every Model Context Protocol (MCP) call. Every MCP call needs a token for an account that has MCP integration. Tag tools also need View tags, and alert tools also need View alerts. The Administrators role includes these permissions. A dedicated role with only those permissions is enough for a tool that reads data and does not change the instance.
Use a service account so the token does not expire while the tool is open. Creating the account needs Users & Groups, which needs the Server licence.
- Select ADMIN in the side menu, then Users & Groups.
- Select Add user.
- Enter a name, such as
mcp-service, and switch on Service Account. - Under Assigned roles, select a role that includes MCP integration, View tags, and View alerts, then save the user.
- Select the user's row, open the User Actions tab, and select Generate Token.
- Copy the token into a secrets manager.
The token is shown once in that dialog, so a copy in a secrets manager confirms the step worked. Generate Token replaces any previous token immediately, and every tool that still has the old token stops connecting until you update it. Refer to Service accounts.