Agent tokens, scopes and access levels

An agent token is how a desktop or terminal client, such as Claude Code, Claude Desktop, Cursor or VS Code, signs in to RankKit SEO's MCP server. Each token has its own name, permissions and expiry, and is tied to the WordPress user who created it.

Create one token per client or person. You can then see who did what in the Change Log, and revoke one token without breaking the others.

Create a token

1. Go to RankKit SEO → AI Agents and click Create token in the Agent tokens card.
2. Fill in the Create agent token form:

Field	Default	What it does
Name	Claude	Shown in the change log next to every edit this agent makes.
Expires	In 90 days	Also In 7 days, In 30 days, In 1 year or Never.
Permissions	Content editor	A preset, then fine-tune each area to None, Read or Write.

3. Click Create token.

RankKit SEO shows "Token created. Copy it now; it will not be shown again." Copy it straight away. It is also filled into the snippets in the Connect an AI client card, so you can copy your client's ready-made configuration.

Tokens start with sr_ followed by 40 characters. RankKit SEO stores only a hash of the token, so nobody can read it back later, including you. If you lose it, create a new one.

Permission areas

Each area can be None, Read or Write. Site audit and analysis and Search Console and GA4 data are read-only, so they offer no Write option.

Area	Label in the form	Covers
content	Posts, pages, terms and images	SEO fields on posts and terms, focus keywords, social fields, schema, alt text, robots meta
redirects	Redirects and 404s	Redirect rules and the 404 log
audit	Site audit and analysis	Running and reading the audit, PageSpeed, duplicates, competitor comparison
analytics	Search Console and GA4 data (read only)	Search Console, GA4, AI crawler and Pro insight reports
ai	AI generation (uses your AI key)	Tools that call your AI provider, such as suggested titles and alt text
settings	SEO settings	Titles, social, identity, sitemaps, robots.txt, llms.txt, IndexNow, modules, backups
history	Change history and reverts	Reading the Change Log, reverting and withdrawing changes

A few tools need two areas. For example, AI alt text that is written to images needs content write and ai write. The MCP tool reference lists the area each tool needs.

Presets

The presets are the same three levels you see on the claude.ai and ChatGPT consent screen.

Area	Read only	Content editor	Full
content	Read	Write	Write
redirects	Read	Read	Write
audit	Read	Read	Read
analytics	Read	Read	Read
ai	None	Write	Write
settings	Read	None	Write
history	Read	Read	Write

What a token can't do

• Anything its WordPress user can't do. A token acts as the user who created it. If that user's role lacks a RankKit SEO permission in the role manager, the token can't use those tools either. If the user is deleted, the token stops working.
• Tools outside its permissions. They are hidden from the client's tool list. If a client calls one anyway, it gets: "This token does not have write access to "content". The site owner can change scopes in RankKit SEO → AI Agents."
• Locked settings. Agent, AI and tracking settings can only be changed by a person in wp-admin, whatever the token's permissions. API keys are never returned to agents.
• Approve its own changes. Approval is reserved for people in wp-admin. See Approval mode, dry runs and undo.

You can't edit a token's permissions after creating it. To change them, create a new token and revoke the old one.

The tokens list

The Agent tokens card lists every token and every claude.ai or ChatGPT connection (shown as " (OAuth)"):

Column	Shows
Name	The token's name and a short hint of the token (first and last characters), so you can tell tokens apart.
Permissions	Each area with read or write access.
User	The WordPress user the token acts as.
Last used	How long ago it was last used and how many calls it has made, or Never.
Expires	The expiry date, Never or Expired.

Click Revoke to stop a token at once. Expired tokens are removed automatically a day after they expire.

Who can create tokens

Creating and revoking tokens needs the AI Agents permission, which only administrators have by default. You can give it to other roles in RankKit SEO → Settings → Roles.

Application Passwords

RankKit SEO also accepts WordPress Application Passwords while Also accept WordPress Application Passwords is on (the default). An Application Password has full access within that user's role and no per-area limits. Tokens are safer because they are scoped and expire. Turn the toggle off if you want every agent to use a token.

FAQ

I lost my token. Can I see it again?

No. RankKit SEO only keeps a hash. Create a new token and revoke the old one.

Should I choose "Never" for expiry?

Only for a client you control closely. A token that expires limits the damage if it leaks.

Why don't I see some tools in my client?

The token's permissions hide tools it can't use, and some tools need RankKit SEO Pro, a Google connection or WooCommerce. Check the Permissions column and the MCP tool reference.