Developer tokens

A developer token is a secret key that lets an app act as you in Rally Studio without signing in through a browser. Rally’s settings call them access tokens. Every token starts with rgt_.

Use a token for:

• AI apps that connect with a header. Some apps, and some setups such as Claude Code with --header, send a token instead of signing you in. See Connect an AI app.
• Agents that run on their own, where nobody is around to sign in.
• The rally command-line tool, which takes a token with Publish games in rally login (or in RALLY_TOKEN) to create and publish web games. See CLI.

If your app can sign in with OAuth, you don’t need a token: signing in shows you exactly what the app asks for, and you can disconnect it at any time.

Permissions

A token can have up to three permissions, the same ones an app asks for when it signs in:

Permission	Scope	Lets the token
Read games	studio:read	List your games and read their objects, properties and scripts. Over MCP, it also covers checking scripts, searching the docs, playtests and screenshots.
Edit games	studio:edit	Everything Read games allows, plus change your games’ Studio drafts. Over MCP, it also covers creating new games.
Publish games	games:publish	Publish games you own. With the rally CLI, it also creates and publishes web games, once Rally staff have approved you.

A token works on every game you own or collaborate on, never on anyone else’s. Publishing also requires that you own the game.

Publishing with a token

When an AI app publishes over MCP, you always approve the request in Studio first. Developer tools that use a token with Publish games, such as the rally CLI, publish directly, without that step. Only give a token Publish games when it needs it.

Create a token

You can create tokens in two places. Both make the same kind of token and list all of your tokens.

In Settings, with the permissions you choose

1. On Rally, open Settings > Connect an AI (rally.place/app/settings#ai).

2. Under Access tokens, enter a Token name that says where you’ll use it, such as Claude Code on my laptop.

3. Under It can, check the permissions it needs. Read games and Edit games are checked to start with, and Read games stays checked whenever another permission is.

4. Choose Create token.

5. Copy the token right away: Rally shows it only once. The setup steps at the top of the page now include it, ready to copy.

On a game’s page, with full access

1. Open Games and choose one of your games to open its page.

2. Under Developer tokens, enter a name in New token.

3. Choose Create token, and copy the token right away. It isn’t shown again.

Tokens made on a game’s page have full access: they can read, edit and publish. The section only appears on games you own, but the token belongs to your account, so it works on all your games, not only that one. To limit what a token can do, create it in Settings instead.

You can have up to 20 tokens at a time, and create up to 10 an hour. Names can be up to 50 characters long.

Use a token

Apps send the token in an HTTP header:

Authorization: Bearer rgt_your_token

For example, to connect Claude Code to Rally’s MCP server with a token:

claude mcp add --transport http rally https://rally.place/api/mcp --header "Authorization: Bearer rgt_your_token"

Apps that read a configuration file often use this shape:

{
  "mcpServers": {
    "rally": {
      "url": "https://rally.place/api/mcp",
      "headers": { "Authorization": "Bearer rgt_your_token" }
    }
  }
}

In Studio, an app that connects with a token appears under the token’s name, and so do its changes in the Activity tab. Naming each token after the app that uses it makes them easy to tell apart.

Keep tokens secret

Anyone who has one of your tokens can act as you in Rally Studio, on every game you can edit, with all of the token’s permissions. Treat tokens like passwords:

• Don’t paste them into chats, issues or screenshots, and don’t commit them to a code repository.
• When an app supports it, store the token in an environment variable or a secret store instead of a plain configuration file.
• Give each app its own token with only the permissions it needs. Then you can revoke one without breaking the others.
• If a token might have leaked, revoke it right away.

Tokens don’t expire. They work until you revoke them.

See and revoke tokens

Settings > Connect an AI lists your tokens under Access tokens, each with its permissions and when it was last used. Tokens created on a game’s page show Full access. The Developer tokens section on your games’ pages lists the same tokens.

To revoke a token, choose Revoke next to it. It stops working at once, for every app that uses it. You can’t see a token again after you create it, so if you’ve lost one, revoke it and create a new one.

Tokens or signing in?

	Signing in	Developer token
How you set it up	The app opens Rally’s sign-in page, and you approve it.	You create a token and paste it into the app.
Permissions	What the app asks for, shown on the approval page	What you choose when you create the token
Shown in Studio as	The app’s name	The token’s name
How it ends	Disconnect under Connected apps	Revoke under Access tokens

Next steps

Connect an AI appSet up Claude Code, Claude or another app.

MCP toolsWhat an app can do with each permission.

CLISign in with a token and publish web games with the rally command-line tool.