Skip to main content
A personal API token authenticates a script, a scheduled job or the MCP server exactly like a signed in session, without a browser.

​
Create a token

1

Open the API tokens card in Settings

Sign in first. A token belongs to your account.
2

Name it after what will use it

A name such as backup-script or laptop-mcp makes revoking the right one possible later.
3

Copy the value immediately

The plaintext value, which starts with asob_, is shown once. asobeast stores only a SHA-256 hash of it and can never show it again.

​
Use a token

Send it as a bearer header on every request.
The path matters. /api/backend/* on the web origin is the same proxy the browser uses, and it forwards the bearer header to the API. When your script runs on the same host as the API, you can call the API directly instead.

​
Revoke a token

Delete it from the same card. Revocation is immediate: the next request carrying that token fails authentication. Revoke rather than rotate AUTH_SECRET when a single token leaks. Rotating the secret signs out every browser session and does not affect tokens at all, because tokens are hashes rather than signed values.

​
Where tokens are used

A personal API token carries the same access as the account that created it, including owner access to the admin surfaces when the owner created it. Never commit one, never paste one into an issue, and give each consumer its own token so a single revocation is enough.

Authentication and accounts

How a request is authenticated and authorized.

The queue dashboard and the OpenAPI surface

What an owner token unlocks.
Last modified on July 31, 2026