Personal access tokens and CLI login

Dashboards are for people. When you want MCP usage in your own weekly report, or a CI job that checks whether an API's readiness score slipped, you need to reach Elva without a browser session. There are two ways in, and they are meant for different things.

What a token is, and what it reaches

A token is scoped to ​one workspace​ and to the user who created it, and begins with the prefix ​elva_pat_​ so it is recognizable on sight in a config file or a leaked log.

Personal access tokens authenticate supported workspace API routes, including reporting and supported CLI workflows. Route support, token scope, and the creator's current workspace role all apply. A token does not grant admin permissions or authorize access to another workspace.

Creating and revoking

Create a named token from account settings and set an expiry when appropriate. Copy the value when it is shown at creation; later views show identifying information rather than the full secret. Replace a lost token.

Revoke a token from the token list when you no longer need it. An expired or revoked token cannot authenticate new requests. Replace credentials used by scheduled jobs before revoking the old token to avoid interruptions.

Signing in from the CLI

For interactive use, run elva auth login. Complete the browser authorization flow; if the browser does not open automatically, open the URL printed by the CLI. The CLI then exchanges the single-use login code for its credentials.

The code can only be redeemed once and the pending login expires if you do not finish it, so an abandoned attempt leaves nothing usable behind.

Where to go next

MCP insights and logs

The data a token is most often used to pull, and what each field means.

Workspaces, members and roles

Which workspace a token belongs to, and who can act inside it.

Use a token in automation

Supply ELVA_TOKEN through your CI secret store or process environment. Do not commit it to elva.json, scripts, or documentation. Confirm the selected workspace and the authenticated identity before running a command that changes resources.

 
elva auth login
elva whoami
elva --workspace "Acme" --json whoami
elva auth logout