Skip to main content

User Access Tokens and the Qvasa MCP: Connecting Claude to Your Account

Written by Amer Shalan

User Access Tokens and the Qvasa MCP: Connecting Claude to Your Account

User Access Tokens let AI assistants like Claude work with your Qvasa data on your behalf — running metric queries, inspecting dashboards, and answering questions conversationally through the Qvasa MCP server. They're designed to be safe by default: every token is scoped, expirable, and tied to a specific user, and a token can never do more than that user already can — the token's scopes are intersected with the user's live permissions on every request. This guide walks through enabling the feature, granting the permission, generating a token, and connecting Claude. It also covers connecting other MCP clients, such as Genspark.

Before you start

  • You need admin access in Qvasa for Steps 1 and 2.

  • The feature must be turned on for your account by the Qvasa team. If you don't see the setting described below, contact your Qvasa representative and we'll enable it for you.

  • Admins keep a kill switch: toggling the account setting off rejects all existing tokens immediately.

Step 1: Enable User Access Tokens for your account

  1. Go to Settings → Account Settings in Qvasa.

  2. Search for "user access" and find the card labeled User Access Tokens.

  3. Click Enable.

Step 2: Grant the permission to a user

Each user who should be able to create tokens needs the manage user access tokens permission:

  1. Go to Settings → Manage Account Members and open the user you want to grant the permission to.

  2. In the permissions list, find the User Access Token Permissions group and check Can manage user access tokens.

  3. Save the user.

With this permission, the user can create, re-scope, revoke, and delete their own tokens. For a general overview of how Qvasa permissions work, see Managing User Permissions in Qvasa.

Step 3: Generate a token

Now, as the user who received the permission:

  1. Go to User Settings → User Access Tokens and click to generate a new token.

  2. Give the token a name (for example, "Claude MCP").

  3. Pick an expiration — the default is 90 days and the maximum is 1 year; shortcut buttons fill in common choices.

  4. Choose the token's scopes. Every token can query metrics and manage its own memory out of the box; the checkboxes grant additional read, write, and special-feature scopes on top of that baseline. You'll only see sections your own permissions allow — a token can never exceed what you can already do.

  5. Click Generate.

Step 4: Copy your token — it's shown exactly once

The next screen shows your new token. Copy it now — Qvasa never stores the raw token (only a one-way hash), so this is your only chance to see it. Store it in a secrets manager, and never share it in plain text. If you lose it, revoke the token and generate a new one.

Step 5: Connect Claude

Right below your token, Qvasa shows the Connect this token to Claude instructions with the install paths for each Claude client:

  • Claude Desktop & claude.ai — connect by URL (recommended). Add Qvasa as a custom connector using the remote MCP server URL shown on the page (https://www.qvasa.com/mcp): in Claude, open Settings → Connectors, click Add custom connector, paste the URL, then click Connect. You'll log into Qvasa in a browser window and land on a permissions page where you configure exactly what Claude is allowed to do — the same scope picker you see when creating a token. With this path there's no download and no token to paste at all.

  • Claude Desktop — one-click bundle. Click Download qvasa-mcp.mcpb on the page, double-click the downloaded file, and paste your token into the install dialog (the field is labeled Qvasa User Access Token). No terminal, no JSON, no Python install.

  • Claude Code, Cursor, and other MCP clients. Expand the manual setup section for copy-paste snippets that point at the qvasa-mcp package — when you generate a token, the snippets are pre-filled with it.

Whichever path you choose, verify the connection by asking Claude: "In your integrations, what qvasa tools do you have?"

Connecting other MCP clients: Genspark

The Qvasa MCP server works with any client that supports remote MCP servers over Streamable HTTP with custom request headers. Genspark is a popular example, and the same pattern applies to similar clients.

One important difference from Claude: the connect-by-URL OAuth sign-in is currently supported only for Claude clients. In Genspark and other clients, skip OAuth entirely and authenticate with your token in a request header, as follows:

  1. Generate and copy a token (Steps 1–4 above).

  2. In the Genspark AI Browser, click the wrench icon at the bottom of the window, choose Add, then Add new MCP server.

  3. Fill in the form: Server name: qvasa · Server type: Streamable HTTP · Server URL: https://www.qvasa.com/mcp · Description: optional, for example "Qvasa support analytics".

  4. In the Request headers field, add your token as an Authorization header: { "Authorization": "Bearer qva_uat_YOUR_TOKEN_HERE" }. Replace everything after Bearer with your full token. The word Bearer and the single space before the token are required.

  5. Save the server, then verify by asking the agent: "In your integrations, what qvasa tools do you have?" A working connection lists the qvasa tools, including qvasa_overview and qvasa_query_metric.

A few notes for non-Claude clients:

  • Don't configure OAuth. If your client shows an OAuth screen or an invalid_redirect_uri error, it is trying the Claude-only OAuth path. Remove any OAuth client settings and use the request-header setup above.

  • Use Streamable HTTP, not SSE. Qvasa's endpoint does not support SSE connections; a client configured for SSE will fail to connect.

  • Rotate before expiry. When your token expires (90 days by default), generate a new one and update the saved Authorization header in your client.

Troubleshooting

  • I don't see the User Access Tokens setting. The feature needs to be turned on for your account by the Qvasa team — contact your Qvasa representative.

  • I don't see User Access Tokens under User Settings. Confirm the account setting is enabled (Step 1) and that your user has the Can manage user access tokens permission (Step 2).

  • I lost my token. Raw tokens can't be recovered. Revoke the lost token from the User Access Tokens page and generate a new one.

  • My token stopped working. Check that it hasn't expired or been revoked, and that the account-level setting is still enabled — turning it off rejects all tokens. Also remember scopes are intersected with your live permissions: if a permission was removed from your user, the token loses it too.

Did this answer your question?