API tokens: creating, copying and revoking

The “Token-uri de acces (API)” (Access tokens (API)) page (blackbox.md/account/api-tokens, “Contul meu” (My account) → “Token-uri API” (API tokens)) is where you create the tokens that an AI assistant (Claude, Cursor, VS Code, etc.) uses to connect to your account through MCP. The page says: “Creați un token pentru a conecta un asistent AI (Claude Desktop, Cursor etc.) la contul dvs. blackbox.md prin MCP. Token-ul oferă acces doar la datele pe care le permiteți explicit mai jos.” (Create a token to connect an AI assistant (Claude Desktop, Cursor, etc.) to your blackbox.md account through MCP. The token gives access only to the data you explicitly allow below.) Tokens are managed only here: the app.blackbox.md panel has no such page.

Available to: any customer signed in to blackbox.md. A token acts on behalf of your account, only with the permissions you checked when you created it.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

How to create a token

1. Sign in to blackbox.md and click “Cont client” (Customer account) in the top bar (on a phone, only the account icon is visible).
2. In the left menu, choose “Token-uri API” (API tokens). On a phone or tablet, open the menu with the “Meniu cont” (Account menu) button. The “Cum funcționează — ghid complet →” (How it works — full guide →) link below the title opens the overview of the AI integration (blackbox.md/info/mcp).
3. In the “Token nou” (New token) card, fill in “Nume token” (Token name) with the name of the AI client or device, for example “Claude Desktop (laptop)”. The name is required and must be 1–80 characters long.
4. Under “Permisiuni” (Permissions), check what the assistant is allowed to do. The first three permissions (read-only) are already checked. The permissions written in red are risky: they allow changes or access to server passwords. When you check one, this warning appears below it: “Atenție: cu această permisiune asistentul AI va putea … Acordați-o doar clienților în care aveți încredere — token-ul poate fi revocat oricând.” (Warning: with this permission, the AI assistant will be able to … Grant it only to clients you trust — the token can be revoked at any time.)
5. Click “Creează token” (Create token). While it works, the button shows “Se creează…” (Creating…).
6. The “Token-ul dvs. nou” (Your new token) card appears above the form. Copy the token right away (see the next section). The form is cleared, and under “Permisiuni” the three read permissions are checked again.

To see which tools each permission unlocks, read Token permissions (scopes). For the permissions a specific task needs, see Example tasks for the AI assistant and the permissions they need.

The “AI-administrator — acces complet” (AI administrator — full access) preset

The “AI-administrator — acces complet” button above the permission list checks all 8 permissions. As long as all of them are checked, this text appears below the list: “Acces complet: asistentul va putea rula orice comandă ca root pe serverele dvs., vedea parole și chei și cheltui din sold. Exact ce are nevoie un administrator AI — nu trebuie să îi mai dați nimic în afară de token.” (Full access: the assistant will be able to run any command as root on your servers, see passwords and keys, and spend from your balance. Exactly what an AI administrator needs — you don't have to give it anything other than the token.) After applying the preset, you can uncheck any permission before you click “Creează token”.

Risk The “Rulează orice comandă ca root pe serverele mele” (Run any command as root on my servers) permission gives root access to all your servers, and the “Plasează și modifică comenzi în numele meu” (Place and change orders on my behalf) permission allows spending from your balance. Anyone who has the token can use it from anywhere until you revoke it. For tasks that only read data, create a separate token without red permissions.

How to copy the token

The “Token-ul dvs. nou” (Your new token) card shows the full token only once.

1. Read the warning “Copiați token-ul acum — nu va mai fi afișat din nou.” (Copy the token now — it will not be shown again.)

2. Click “Copiază” (Copy). For two seconds, the button shows “Copiat!” (Copied!). If the button text does not change, your browser does not allow automatic copying: select the token with the mouse and copy it manually.

3. Paste the token into your AI client or into a password manager.

4. Use the details in the “Conectarea unui client AI” (Connecting an AI client) box, which says: “Adăugați această conexiune în setările Claude Desktop / Cursor (sau orice client compatibil MCP):” (Add this connection in the settings of Claude Desktop / Cursor (or any MCP-compatible client):)

   Row	Value
   “URL server” (Server URL)	https://api.app.blackbox.md/mcp
   “Antet de autorizare” (Authorization header)	Authorization: Bearer bbx_pat_… (with your full token)

5. Click “Gata” (Done). The card closes, and the token can no longer be shown. The same happens if you reload the page or leave it.

A token has the form bbx_pat_ followed by 43 characters (letters, digits, - and _). Steps for each client: Connecting in the Claude app (custom connector) (there the token goes in the x-api-key header, without “Bearer”) and Connecting from Claude Code, Cursor, VS Code and other clients.

Important BLACKBOX does not store the token in plain text, only a cryptographic fingerprint of it. Not even we can show it to you again. If you have lost it, create a new token and revoke the old one.

The token list

Below the form, a table shows all your tokens, newest first:

When you have no tokens, the page shows “Nu aveți încă token-uri de acces.” (You don't have any access tokens yet.)

How to revoke a token

1. In the table, click “Revocă” (Revoke) in the token's row.
2. The “Revocați token-ul?” (Revoke the token?) window opens with the text “Revocați acest token? Orice client AI care îl folosește va pierde accesul imediat.” (Revoke this token? Any AI client that uses it will lose access immediately.)
3. Click “Revocă” to confirm or “Anulează” (Cancel) to back out.
4. The button shows “Se revocă…” (Revoking…). Then the row turns gray, and instead of the button you see the word “Revocă” in gray italics. If the row stays unchanged, the revocation failed: reload the page and try again.

Revocation takes effect immediately: on its next request, the AI client gets the error token not recognised (revoked, expired, or unknown). Revocation cannot be undone. Revoked tokens cannot be deleted: they stay in the list, grayed out.

When a token stops working

By default, tokens do not expire, and the page does not let you set an expiry date. Replace them periodically: create a new token, put it in the client and revoke the old one.

Limits and errors

The errors the AI client receives when it connects are explained in MCP limits and error codes.

Frequently asked questions

I closed the card before copying the token. Can I get it back? No. Create a new token and revoke the one you didn't copy, so that no unused token stays in the list.

How do I add a permission to an existing token? You can't. Create a new token with the permissions you need, replace the old one with it in your AI client, then revoke the old one.

Do I get an email when a token is created or revoked? No, no email is sent. Check the list and the “Ultima utilizare” (Last used) column periodically, and revoke any tokens you don't recognize.

Why does “Ultima utilizare” still show “niciodată” (never)? The first use is recorded immediately, but the page does not refresh by itself: reload it. If you still see “niciodată”, the AI client has not connected with this token yet: check the address and the header in the client's settings.

Can I create or revoke tokens through the AI assistant or from the panel? No. Tokens are created and revoked only on this page, in your blackbox.md account.

Can I use the token for another API too? No. The token is accepted only at the MCP address https://api.app.blackbox.md/mcp.

How many tokens should I create? One for each AI client or device, with a clear name. If you lose your laptop, you revoke only its token. More recommendations in Token and AI agent security.