API tokens

Frostbyte uses bearer tokens for programmatic access via the Plugin and the MCP server. Tokens are shown once at generation, stored hashed, and revocable any time.

Generating a token

In account settings, scroll to Connected agents. Indie, Studio, and Enterprise users can click Generate token. The token displays once; copy it straight into your client or password manager. Frostbyte stores only a hash, so it can't be shown again.

The token is 64 hex characters. Treat it like a password.

Using the token

Include the token in the Authorization header of any request to MCP:

Authorization: Bearer <your-token>

The Plugin handles this for you; paste the token once during install.

Revoking and rotating

To rotate, click Generate token again. The old token stops working immediately, and any client session using it fails on its next request. Update your client with the new token and you're back online.

To revoke without replacement, click Delete token. Your account no longer accepts bearer auth until you generate a new one.

There's no token expiry in v1. Tokens are valid until you rotate or revoke them.

Scope

A token grants the same access you have: every project you're a member of, every task you can see in the UI. There are no per-project tokens or fine-grained scopes in v1; that's a deliberate simplification for the small-team case.

Stricter access control, like one scoped token per integration, is an Enterprise roadmap item.

Tier requirement

Tokens for the plugin and MCP server require Indie or higher. Free accounts can use every browser-based feature, but they can't generate a working agent token.

What gets logged

Every request authenticated by a bearer token records you as the actor in the Activity feed, with a marker showing the action came from an agent rather than your browser.

What's next

• Connect the Plugin using the token you just generated.
• Read about the MCP server for the full tool surface.