Skip to main content

API tokens

API tokens are long-lived credentials you create under Account → API & MCP (also linked from Settings → API credentials). That page has two tabs: Tokens (create / revoke) and MCP (copy client config).

What they unlock​

  • Universal MCP at /api/mcp/ (one server for all your browsers): list, create, delete, mint, and drive
  • Consumer REST calls as your user (Authorization: Bearer stw_…)
  • Minting short-lived drive tokens for a single browser (browsers_mint_token or Configure MCP on a session)

What they cannot do​

  • Manage other users’ data
  • Call system-admin (/admin/*) endpoints — those require a login JWT
  • Create or revoke other API tokens (token CRUD requires a login session)

Drive tokens (session-scoped)​

A drive token is a short-lived JWT (scope=drive) bound to one session_id. Use it as Authorization: Bearer … on /api/mcp/ for page-driving agents.

A drive token cannot list, create, delete, start/stop other browsers, mint more tokens, or call account/REST APIs. Keep the account stw_… token server-side; do not paste it into an agent that will visit untrusted pages.

Lifecycle​

  1. Create a named token on the Tokens tab (optional expiration)
  2. Copy the secret once — Stairway stores only a hash
  3. The web UI may keep the secret in this browser’s local vault for the MCP tab (and session Configure MCP dialogs)
  4. Revoke anytime from the Tokens tab

See MCP setup for client configuration on the same page.