What this is for
Every client except claude.ai and Claude Desktop connects to Guardway MCP with a Guardway API token, which starts withgwp_. The token’s scopes decide which tools the client may call; your role decides what those tools may change.
How to configure
Skip this for claude.ai and Claude Desktop.1
Create an API token
In the dashboard, open Settings → API tokens and choose Create token. Give it a Name and pick its access. Under API keys, choose Read and manage API keys to make changes, Read API keys to only look, or No access to API keys. Under Reports (read-only), tick the reports the client may read: Usage & spend (read), Audit log (read) and Setup status (read). Under Policies, choose Read and change policies & guardrail rules to let the client change them, Read policies & posture to only look, or No access to policies. Members, Operations (alerts & anomalies) and Connections (providers & MCP servers) are chosen the same way: no access, read, or read and change (see Token scopes). Under Endpoints & people, choose Read endpoints & people or No access to endpoints & people. Under Discovery, choose Read and refresh discovery to let the client refresh cloud agents, Read discovery to only look, or No access to discovery. Under FinOps, choose Read spend and change budgets to let the client set budgets, Read spend & budgets to only look, or No access to spend or budgets. Under Supply chain, choose Read the supply chain or No access to the supply chain. Pick a Lifetime of 7, 14 or 30 days.
2
Copy the token
Copy the token: this is the only time it is shown. A good starting set for managing keys and reading reports is
keys:read or keys:write, usage:read, audit:read and policies:read.Only Owners and Admins can create API tokens. A token acts as the member who created it, with that member’s current role, and expires after its lifetime. Rotate or revoke it in Settings → API tokens. Treat it like a password: keep it out of files you commit.
Token scopes
Each tool needs a scope on the token. Usage & spend and Audit log are independent: pick either, both or neither. Policies, Members, Operations (alerts & anomalies), Connections (providers & MCP servers), Endpoints & people, Discovery, FinOps and Supply chain are one level each, chosen like API key access; read and change (or read and refresh) always includes read. Endpoints & people and Supply chain have no change level.whoami works with any token, and lists what the token can do in each area. A token with Read providers & MCP servers but not Read policies & posture sees MCP servers, and the tools it discovers, without tool names. Password resets are never open to a token, and no token can scan a repository. When Claude checks your organization’s setup, it sees how many machines are enrolled and reporting, as counts only: who uses them and their hostnames need Read endpoints & people, and IP addresses are never shown.
claude.ai and Claude Desktop have no token scopes: they can use every tool except the prompt previews, which you switch on per connector (see Prompt previews), and what they can do follows your role. A Read Only member can only read, and the Owner-only team changes above still need the Owner.