Tokens
A token is a key that lets something that is not you reach your data: a program, an application, or an AI agent. You mint tokens under Storage, and you revoke them when they are no longer needed. There are two kinds.
API tokens
An API token is a personal key that acts as you. It starts with tmp_. Each has a name you choose. An expiry and a scope are yours to add if you want them. The scope is a list of the parts of the hub the token may reach, such as your markdown content, or projects for reading only. A token with no scope has your full authority.
The secret is shown once, when the token is minted, and the hub keeps only a fingerprint of it. Copy it then. API tokens are always yours; they do not belong to a workspace. An API token is also the key an agent brings when it connects to the hub over MCP.
An application gets API tokens of its own, bound to the application rather than to a person, and a persona gets acting tokens that let it work on your behalf. Those are minted from the application and from the persona, not here.
Storage tokens
A storage token is bound to one bucket and reaches that bucket's data and nothing else. It starts with adh_. It is not tied to any person, so it keeps working when people come and go. On an organization workspace, the tokens belong to the organization.
- APIs & protocols
- MCP