# Use API access

> Create personal access tokens for scripts and MCP clients, and send your Livespace's events to your own systems with webhooks.

In Settings › **API Access**, you make personal access tokens, so a script or an MCP client can use Dvina as you. Admins also add webhooks there, to send the Livespace's events to their own systems.

API Access comes with the Enterprise plan. Every member can make their own tokens; only owners and admins see **Webhooks**.

## Create a token

1. Open Settings and choose **API Access**.
2. Under **Personal Access Tokens**, choose **Create Token**.
3. Enter a **Name**, so you know later what uses it.
4. Choose the **Access**: **Read only** or **Read and write**.
5. Choose when it **Expires**: **In 30 days**, **In 90 days**, **In 365 days** or **Never expires**.
6. Choose **Create Token**.
7. Under **Copy Your Token**, copy the token and keep it somewhere safe. This is the only time it's shown.

A token works as you, in the Livespace you made it in, with your role there now. A **Read only** token can read but can't add or change anything.

To use a token with an MCP client, see [Connect with an API key instead of OAuth](/docs/dvina-mcp/overview#connect-with-an-api-key-instead-of-oauth).

## Check, rotate or revoke a token

Your tokens are listed under **Personal Access Tokens** with their access. Choose one to see what **Starts With**, its **Access**, when it was **Last Used** and when it **Expires**.

- **To replace a token**, choose **Rotate…**, then **Rotate** to confirm. A new token replaces it, and the old one stops working at once. Copy the new token under **Copy Your Token**.
- **To stop a token**, choose **Revoke…**, then **Revoke** to confirm. Anything that uses it stops working at once.

Making, rotating and revoking a token is recorded in the [audit log](/docs/teams/audit-log).

## Add a webhook

A webhook sends the Livespace's events, the same records as the [audit log](/docs/teams/audit-log), to an address you choose.

1. In Settings › **API Access**, under **Webhooks**, choose **Add Webhook**.
2. Enter a **Name** and the **URL**. Use a public HTTPS URL.
3. Under **Events**, leave it empty for every event, or list actions and areas, such as `member.added` or `sharing.*`.
4. Choose **Add**.
5. Under **Copy the Signing Secret**, copy the secret. This is the only time it's shown.

If Dvina says **This address can't be reached from Dvina**, use a public HTTPS URL.

### Check each request's signature

Dvina sends events in batches, as JSON, and signs every request. Use the signing secret to check that a request came from Dvina:

- Each request has an `X-Dvina-Signature` header like `t=<timestamp>,v1=<signature>`.
- The signature is an HMAC-SHA256, in hex, of the timestamp, a period, and the request body, made with your signing secret.
- Compute it yourself and compare. Reject a request whose signature doesn't match or whose timestamp is too old.

## Check or change a webhook

Your webhooks are listed under **Webhooks** with their status: **On**, **Paused** or **Failing**. Choose one to see its details.

- **To change it**, edit its **Name**, **URL** or **Events**, then choose **Save**.
- **To pause it**, turn off **Send Events**. Turn it on again to start sending again.
- **To see how it's doing**, check its **Status** and how many events were **Sent**. A failing webhook shows its **Last Error**. Dvina keeps trying, and records the failure in the audit log.
- **To change its secret**, choose **New Signing Secret…**, then confirm. Requests are signed with the new secret at once, so update the receiver right away.
- **To remove it**, choose **Delete…**, then **Delete** to confirm. Nothing more is sent to it.

## Related

- [Use Dvina from other apps with MCP](/docs/dvina-mcp/overview)
- [Use the audit log](/docs/teams/audit-log)
- [Teams overview](/docs/teams/overview)