Authentication and access

Both authentication methods act as your Nimt user. Neither expands your workspace membership or grants platform administration access.

	OAuth	Personal access token (PAT)
Best fit	Interactive clients with browser sign-in	Clients with bearer-token support or non-interactive use
Workspace	Selected when you approve the connection	Your active workspace when you create the token
Credential handling	Managed by your client	Stored and supplied by you
Remove access	Disconnect the approval in Connected apps	Revoke the token in Personal access tokens

Workspace boundaries

A connection is tied to one workspace. It can discover projects there and use project-scoped tools only for projects belonging to that workspace. Knowing a project ID from a different workspace does not give the connection access to it. Switching workspaces in the Nimt app does not retarget an existing connection. To use another workspace, approve a separate OAuth connection or create a token while that workspace is active. If your client supports multiple server entries, give them distinct names so you can tell them apart. Nimt checks your current membership on requests. If you lose access to the workspace or your account is disabled, the credential no longer authorizes MCP access there.

Permissions

Scope	Meaning
`mcp:read`	Allows read tools. Required to connect to the current MCP.
`mcp:write`	A permission for write operations within your existing access. There are no write tools in the current customer catalog.
`offline_access`	OAuth only: allows the client to refresh its connection without asking you to sign in for every access token.

OAuth clients request scopes, which appear on the consent screen. They may also request the standard openid, profile, and email scopes for account identity and profile information. Review every permission before approving.

PATs created in Nimt currently include both mcp:read and mcp:write; the creation form does not offer a read-only option. OAuth may also request both. The current tools are read-only, but a credential with write permission is not a read-only credential. Revisit your approvals as the pre-release catalog evolves.

A permission does not create a tool or bypass the workspace checks. Your client’s approval prompts are an additional control; they do not replace Nimt’s authorization.

Connect with OAuth

Use a personal access token

Create, store, and revoke a token.

​Workspace boundaries

​Permissions

Connect with OAuth

Use a personal access token

Workspace boundaries

Permissions