API tokens
API tokens are long-lived credentials you create under Account → API tokens (also linked from Settings → API credentials).
What they unlock
- Universal MCP at
/api/mcp/(one server for all your browsers) - Consumer REST calls as your user (
Authorization: Bearer stw_…)
What they cannot do
- Manage other users’ data
- Call system-admin (
/admin/*) endpoints — those require a login JWT - Create or revoke other API tokens (token CRUD requires a login session)
Lifecycle
- Create a named token (optional expiration)
- Copy the secret once — Stairway stores only a hash
- The web UI may keep the secret in this browser’s local vault for Configure MCP
- Revoke anytime from the API tokens page
See MCP setup for client configuration.