Authentication
Call Parcel from scripts and integrations with a personal REST API token.
Parcel's REST API lives under https://app.use-parcel.com/api. The hub, the CLI and your scripts use the same routes, and Parcel checks every rule (access, tool rules, the review workflow, features) on each call.
curl -H "Authorization: Bearer $PARCEL_TOKEN" https://app.use-parcel.com/api/meCredentials
Send a credential in the Authorization header as Bearer <token>.
| Credential | Looks like | Made by | Lifetime |
|---|---|---|---|
| REST API token | pat_ and 43 characters | You, on Connect under Your credentials | 7, 30, 90 or 365 days, or no end date |
| CLI access token | A signed JWT | parcel login; parcel token prints one | Minutes; the CLI refreshes it |
A REST API token is the one for scripts and integrations.
What a token can do
- It acts as you, in the workspace you made it in. Nothing in a request can point it at another workspace.
- It can do what you can do at the time of the call, nothing more. A role change or a removed grant applies to the next call, and when you leave the workspace your tokens stop working.
- It works for the REST API only. The MCP address refuses it; MCP apps sign in with OAuth.
- It never sees confidential memories, notebooks or audit details that only the hub shows.
- Each person holds up to 25 working tokens per workspace.
Making, refreshing and revoking
- Tokens are made and refreshed only in the hub, signed in. A token can list and revoke tokens but cannot make or refresh one, so a leaked token cannot give itself a successor.
- The token is shown once, when it is made or refreshed. Parcel keeps only a hash and its last four characters.
- Refresh replaces the secret and restarts its lifetime; the old secret stops working at once. Revoke stops it at once.
- Making, refreshing and revoking a token is recorded in the audit log. The last use of each token is kept, to the minute.
- Admins can see and revoke every token in the workspace, and can switch tokens off under Admin, Features (REST API tokens). While they are off, every token answers
401.
Errors
Errors answer with {"error": "..."}.
| Status | Meaning |
|---|---|
401 | No credential, or one Parcel refuses |
403 | You may not make this call |
404 | It does not exist, or it belongs to a feature that is off |
Conventions
- Request and response bodies are JSON unless an endpoint says otherwise (uploads use
multipart/form-data, downloads return files). - Dates are ISO 8601 in UTC, such as
2026-10-25T09:12:00.000Z. - Admin endpoints answer
403for everyone but the workspace's owners and admins. - An endpoint that belongs to a feature answers
404while your admins have that feature switched off.
Reference
Every endpoint has its own page under Reference, with its parameters, request and response schemas, and examples.
parcel review
Check out and review skills and tools waiting for you.
Get your account GET
Your profile and groups, how many skills you may use, author and review, and when your clients last reached Parcel. Claude on the web and Claude Desktop share one connector, so their use counts together. Any member can call it.