We’ve got a solid group of folks in Enterprise accounts here in the community, so this one’s for you.
If you manage a Coda Enterprise org, you now have more granular control over how members connect to the Coda MCP, specifically around personal access tokens (PATs).
What’s new
In your Admin settings under Security > MCP controls, you can now set PAT access to one of three levels:
- Allow for all members (default behavior)
- Allow for selected members (you pick who)
- Allow for no members (PAT auth disabled org-wide)
Why this matters
PATs and OAuth serve different use cases. OAuth is the right fit for most members connecting through tools like Claude or Cursor. PATs are better suited for technical users building internal scripts or custom integrations, and because they’re long-lived credentials that don’t require re-authentication, they carry more risk if left unmanaged.
This setting allows admins to align MCP access with their org’s security posture.
A few things worth knowing before you change this setting
Restricting PAT access immediately blocks existing tokens. Any member currently connected to the MCP via a PAT will start seeing failures, so it’s worth giving your org a heads-up before you make the change.
Restricting access doesn’t permanently revoke tokens. If you lift restrictions later, existing connections will be automatically restored. If you want to permanently revoke tokens, that’s done through the Admin API.
Full details and step-by-step instructions are in the help doc.
