A personal access token is how your own code and your own AI tools talk to
Sayli. It authenticates the Sayli API and the inbound MCP server. Every token
starts with the prefix sayli_pat_, so it is easy to spot in a log and easy to
rotate.
Create one
Go to Settings, then Developer, under Advanced. This is where your tokens live.
Give it a name you will recognize later, like "laptop CLI" or "n8n workflow", and pick how long it should live. Copy the token now. You will not see it again.
The expiry menu starts on 90 days, so an integration you set up and forget stops working three months later, and the failure looks like a 401 rather than anything about expiry. Pick "Never expires" for a key you will rotate yourself, or write the date down. You can also set 30 days or a year.
Use it
Send the token as a Bearer token in the Authorization header. Meetings live inside an organization, so list your organizations first, then use an org id to read its meetings.
# Who am I in? Grab an org id from the response.
curl https://api.sayli.ai/api/v1/orgs/ \
-H "Authorization: Bearer sayli_pat_your_token_here"
# List that org's meetings.
curl https://api.sayli.ai/api/v1/orgs/{org_id}/meetings/ \
-H "Authorization: Bearer sayli_pat_your_token_here"Revoke it
If a token leaks or a laptop walks off, revoke it from the same Developer panel.
The token stops working at once, and nothing else you own is affected.
One other thing revokes a token, and it is easy to mistake for a broken integration: Sign out everywhere, in Settings under Account, revokes every token along with every session. That is deliberate, so a key copied from a lost device cannot outlive the sign-out. The fix is to issue a new one.
A token can read your meetings. Do not paste it into a shared doc or commit it to a repo. Rotate it if you are unsure.