# Getting started and Tape token permissions

## What you need

You need a Tape Vault invitation to set up a new organisation, and a Tape account with suitable access to the workspaces and apps you want to monitor. A Tape owner or administrator should set up the connection.

Already have access? Go straight to [Tape Vault](https://tape-vault.jmc.tools/) and sign in with your email.

## Create a personal access token in Tape

Create a PAT for Tape Vault in Tape's token settings. It starts with `tape_pat_`. Give it access to the **workspaces** you want to monitor; selecting individual apps alone does not grant workspace access.

Choose these capabilities:

| Capability | Scope | Why it is needed |
|------------|-------|------------------|
| Read organization | `organization:read` | Identify the organisation and its members. |
| Read workspaces | `workspaces:read` | List workspaces for setup. |
| Read apps  | `apps:read` | List apps and their structure. |
| Read records | `records:read` | Read record changes and revision history. |
| Manage webhooks | `webhooks:manage` | Connect and verify change notifications. |

**For record recovery**, also grant **Edit records** (`records:edit`). This permits record creation, updating, deletion and restoration within the credential's effective access. You can leave it out for an audit-only connection.

A token cannot grant more access than its Tape user already has. PAT permissions and content selection are fixed at creation; create a replacement PAT if they need changing. Existing user API keys remain supported. OAuth access tokens are not supported for this setup.

Automation backups are not available yet, so no automation capability is required.

[Tape's PAT instructions](https://developers.tapeapp.com/docs/api/personal-access-tokens/) · [Tape capability reference](https://developers.tapeapp.com/docs/api/capabilities/)

## Set up your organisation


1. Open the invitation supplied to you.
2. Enter your details and paste the Tape token into the token field.
3. Continue to workspace selection and choose the apps to monitor.
4. Follow the setup status page while the connections are created and verified.
5. When setup completes, return to Tape Vault and sign in using your email code.

Validation uses read-only checks. A successful check does not prove that every recovery action or every selected resource will be permitted.

## If setup is interrupted

Reopen the **same unexpired invitation** to continue from its saved step. If a selection was saved but setup could not start or finish, use **Retry setup** on the status page.

During unfinished setup, **Replace the Tape token for this setup** lets you save a validated replacement for the same Tape organisation. It is unavailable while a saved job is queued/running or after setup is complete.

An expired invitation cannot continue changing setup. Ask the person who invited you for help. If the organisation already exists from an earlier attempt, do not repeatedly create new invitations for it; ask for the existing setup to be checked.

## Sign in

Use **Sign in to Tape Vault** with the email that has been given organisation access. User codes are valid for 20 minutes; use the newest code you requested and its verification page. An old verification link cannot request a new code.

After signing in, you land on **Your organisations**. An invitation authorises setup; it does not sign you in as the organisation owner.

Never send a PAT, one-time code or full invitation link in a support message or screenshot.

Last updated: 10 November 2026.