Tokens API

Personal access tokens are what authorise every REST and MCP call. They look like zg_live_<id>_<secret> in production and zg_test_<id>_<secret> everywhere else, and the plaintext value exists exactly once: in the response that created it.

You can mint one in the app under Account Settings → API Tokens, or through the mint endpoint below. Minting and revoking announce themselves as token.created and token.revoked, behind the token:view ability, so a security mirror can watch credential churn on the team.

Background

AuthorizationCopy Anchor Link

Ownership is necessary but not sufficient: each route demands its matching token:* ability as well, because a token scoped to nothing but dashboard:read must not be able to enumerate and revoke every other token its owner holds. Tokens belonging to another person are invisible: every route returns 404 RESOURCE_NOT_FOUND for an id outside the caller's own set, so the API cannot be used to probe which ids exist.

EndpointsCopy Anchor Link

Related

AuthenticationThe scope:team: tuple and the bearer header.Ability CatalogueEvery ability string a token can carry.Tenancy & ScopesHow team and project scoping combine, and why a guest's token is always project-scoped.token.* eventsPersonal access token minting and revocation.