OAuth 2.1 (Claude, ChatGPT, Grok)
When you connect an assistant, it redirects you to a PaperOffice sign-in page. After you confirm, the assistant receives a short-lived access token and a refresh token bound to your user. No password and no long-lived key is stored at the assistant provider. PKCE is mandatory; the connection appears in PaperOffice under Account → API → MCP connections and can be revoked there.
User token po_ut_ (Cursor and headless clients)
A personal bearer token created under Account → API. It carries the permissions of the user who created it. Ideal for Cursor and scripts. Rotate it regularly and store it outside version control.
Group token po_gt_
Issued by an account administrator for a team. Members share the token, actions are attributed to the group. Use it when many people need the same, deliberately limited scope.
Blocked for MCP: po_sk_ and po_pk_
po_sk_(secret key) is the server-to-server key of the REST API with full account power. It must never sit in a chat client and is rejected by the MCP server.po_pk_(publishable key) is meant for browser widgets with budget caps and is also rejected.
If a client shows unauthorized or token type not allowed, this is usually the reason.
Token hygiene
- One token per person and per client.
- Deactivate tokens of people who leave the team.
- Check Account → API usage if in doubt — every call is attributed to its token or OAuth connection.