Skip to main content

User Access Tokens and the Qvasa MCP: Connecting Claude to Your Account

Written by Amer Shalan

User Access Tokens and the Qvasa MCP: Connecting Claude to Your Account

User Access Tokens let AI assistants like Claude work with your Qvasa data on your behalf — running metric queries, inspecting dashboards, and answering questions conversationally through the Qvasa MCP server. They're designed to be safe by default: every token is scoped, expirable, and tied to a specific user, and a token can never do more than that user already can — the token's scopes are intersected with the user's live permissions on every request. This guide walks through enabling the feature, granting the permission, generating a token, and connecting Claude.

Before you start

  • You need admin access in Qvasa for Steps 1 and 2.

  • The feature must be turned on for your account by the Qvasa team. If you don't see the setting described below, contact your Qvasa representative and we'll enable it for you.

  • Admins keep a kill switch: toggling the account setting off rejects all existing tokens immediately.

Step 1: Enable User Access Tokens for your account

  1. Go to Settings → Account Settings in Qvasa.

  2. Search for "user access" and find the card labeled User Access Tokens.

  3. Click Enable.

Step 2: Grant the permission to a user

Each user who should be able to create tokens needs the manage user access tokens permission:

  1. Go to Settings → Manage Account Members and open the user you want to grant the permission to.

  2. In the permissions list, find the User Access Token Permissions group and check Can manage user access tokens.

  3. Save the user.

With this permission, the user can create, re-scope, revoke, and delete their own tokens. For a general overview of how Qvasa permissions work, see Managing User Permissions in Qvasa.

Step 3: Generate a token

Now, as the user who received the permission:

  1. Go to User Settings → User Access Tokens and click to generate a new token.

  2. Give the token a name (for example, "Claude MCP").

  3. Pick an expiration — the default is 90 days and the maximum is 1 year; shortcut buttons fill in common choices.

  4. Choose the token's scopes. Every token can query metrics and manage its own memory out of the box; the checkboxes grant additional read, write, and special-feature scopes on top of that baseline. You'll only see sections your own permissions allow — a token can never exceed what you can already do.

  5. Click Generate.

Step 4: Copy your token — it's shown exactly once

The next screen shows your new token. Copy it now — Qvasa never stores the raw token (only a one-way hash), so this is your only chance to see it. Store it in a secrets manager, and never share it in plain text. If you lose it, revoke the token and generate a new one.

Step 5: Connect Claude

Right below your token, Qvasa shows the Connect this token to Claude instructions with the install paths for each Claude client:

  • Claude Desktop & claude.ai — connect by URL (recommended). Add Qvasa as a custom connector using the remote MCP server URL shown on the page (https://www.qvasa.com/mcp): in Claude, open Settings → Connectors, click Add custom connector, paste the URL, then click Connect. You'll log into Qvasa in a browser window and land on a permissions page where you configure exactly what Claude is allowed to do — the same scope picker you see when creating a token. With this path there's no download and no token to paste at all.

  • Claude Desktop — one-click bundle. Click Download qvasa-mcp.mcpb on the page, double-click the downloaded file, and paste your token into the install dialog (the field is labeled Qvasa User Access Token). No terminal, no JSON, no Python install.

  • Claude Code, Cursor, and other MCP clients. Expand the manual setup section for copy-paste snippets that point at the qvasa-mcp package — when you generate a token, the snippets are pre-filled with it.

Whichever path you choose, verify the connection by asking Claude: "In your integrations, what qvasa tools do you have?"

Troubleshooting

  • I don't see the User Access Tokens setting. The feature needs to be turned on for your account by the Qvasa team — contact your Qvasa representative.

  • I don't see User Access Tokens under User Settings. Confirm the account setting is enabled (Step 1) and that your user has the Can manage user access tokens permission (Step 2).

  • I lost my token. Raw tokens can't be recovered. Revoke the lost token from the User Access Tokens page and generate a new one.

  • My token stopped working. Check that it hasn't expired or been revoked, and that the account-level setting is still enabled — turning it off rejects all tokens. Also remember scopes are intersected with your live permissions: if a permission was removed from your user, the token loses it too.

Did this answer your question?