API tokens

Frostbyte uses bearer tokens for programmatic access via the Plugin and the MCP server. Tokens are shown once at generation, stored hashed, and revocable any time.

Creating a token

In account settings, find AI agents and click Connect your agent (Indie, Studio, and Enterprise). Pick your tool and Frostbyte creates a token and shows it inside that tool's setup steps. It displays once; Frostbyte stores only a hash, so it can't be shown again.

Each connection gets its own token, labelled with the tool and the date, so you can see which tools are active and revoke them one at a time. Treat a token like a password.

Using the token

Include the token in the Authorization header of any request to MCP:

Authorization: Bearer <your-token>

The Plugin handles this for you; paste the token once during install.

Renaming and revoking

The AI agents table lists every token with its tool, when it was created, and when it was last active. Rename changes the label. Revoke stops that token on its next request and leaves your other tools connected.

To rotate, connect the tool again to get a new token, then revoke the old one.

There's no token expiry in v1. Tokens are valid until you revoke them.

Scope

A token grants the same access you have: every project you're a member of, every task you can see in the UI. There are no per-project tokens or fine-grained scopes in v1; that's a deliberate simplification for the small-team case.

Stricter access control, like one scoped token per integration, is an Enterprise roadmap item.

Tier requirement

Tokens for the plugin and MCP server require Indie or higher. Free accounts can use every browser-based feature, but they can't generate a working agent token.

What gets logged

Every request authenticated by a bearer token records you as the actor in the Activity feed, with a marker showing the action came from an agent rather than your browser.

What's next

• Install the Plugin for Claude Code or Codex.
• Read about the MCP server for the full tool surface.