Manage connections and credentials
Choose OAuth when possible and keep token access under control.
The Connections page shows connected tools and lets you revoke an individual connection. OAuth is preferred because access is granted through the normal browser sign-in and can be revoked without handling a raw token.
Some clients require a personal access token. Generate it only in the connection flow, copy it once, and store it in the client’s secret configuration. A SpecMCP personal access token begins with gsp_. Do not send it in chat, include it in source control, or share it across users.
Scoped tokens for CI/CD
A personal access token can be narrowed to a single certification scope or to specific specifications. Use a scoped token for automation, such as a CI/CD pipeline that checks one product against its scope, so the token grants only the access that job needs. A scoped token still counts against your seat and its usage; revoke it when the pipeline is retired.
Organization administrators manage shared integration tokens, such as the Notion connection, from Team. Revoke a token whenever an integration is removed, a device is lost, or its secret may have been exposed.