API tokens

Generate, rotate, and revoke bearer tokens used by the Indie-tier plugin and MCP server. Plaintext shown once.

Frostbyte uses bearer tokens for programmatic access via the Plugin and the MCP server. Tokens are shown once at generation, hashed at rest, and revocable any time.

Generating a token

In account settings, scroll to Connected agents. Indie, Studio, and Enterprise users can click Generate token. The token displays once, copy it immediately into your client (or password manager). Frostbyte stores only its SHA-256 hash, so we cannot show it to you again.

Token format: 64 hex characters, generated by crypto.randomBytes(32).toString("hex"). Treat it like a password.

Using the token

Include the token in the Authorization header of any request to MCP or the API:

Authorization: Bearer <your-token>

The Plugin handles this for you, paste the token once during install.

Revoking and rotating

To rotate, click Generate token again. The old token is replaced immediately; any existing client sessions that authenticated with the old token start failing on the next request. Update your client with the new token and you're back online.

To revoke without replacement, click Delete token. Your account no longer accepts bearer auth until you generate a new one.

There's no token-expiry mechanism in v1. Tokens are valid until you rotate or revoke.

Scope

A token grants the same access the user has, every project they're a member of, every task they can see in the UI. There are no per-project tokens or fine-grained scopes in v1; this is a deliberate simplification for the small-team use case.

If you want stricter access control (e.g. one token per integration, with scoped access), that's an Enterprise tier roadmap item.

Tier requirement

API tokens for the plugin and MCP server require Indie or higher. Free accounts can still use browser-based project features, but they cannot generate a working agent token.

The token requirement is still a security boundary: every MCP request is scoped to the authenticated user's project access, and rotating or revoking a token immediately cuts off bearer-authenticated agent access.

What gets logged

Every request authenticated by a bearer token records the user as the actor in the Activity feed. You can see which actions came from your agent vs your browser by looking at the via field on each activity entry.

What's next

Last updated