Auth & Security

Three key rules for the Token

1. Shown exactly once — the plaintext is displayed only at generation time; you cannot retrieve it after closing the dialog. Save it into your secret store immediately (env var, Secret Manager, 1Password, etc.).
2. No auto-expiry — the token stays valid until you explicitly rotate or revoke it. No periodic renewal needed.
3. No grace period — after rotate/revoke, the very next request returns 401. No cache, no transition window.

Rotate

When: suspected leak, employee departure, periodic rotation per company policy.

How: console → project → Open Platform → Reset MCP Token.

A new token is issued; the old one dies immediately. Update mcp.json with the new token.

Revoke

When: project decommissioning, temporarily disable integration.

How: console → project → Open Platform → Revoke MCP Token.

The token becomes invalid instantly. Recovery requires generating a fresh token (revoked tokens cannot be reactivated).

Permission model

Your role	What you can do
Any team member	View whether a token exists; see the 12-char prefix (lox_mcp_XXXX)
Team admin / owner	Generate / rotate / revoke

Protected projects: if the project has protected mode enabled (to prevent accidental disruption of long-term integrations), once an MCP Token exists both reset and revoke return 403; first-time generation is still allowed.

What the token prefix is for

The console shows the current token's 12-char prefix (e.g. lox_mcp_ZNWw). Use it to verify "is the token in my mcp.json still the current one?" across rotation history — compare the first 12 chars of the Bearer value in your request headers against this prefix.

The prefix is NOT part of the secret material — it's safe to paste into tickets or chat for diagnostics. Never paste the full token.

Security best practices

• ❌ Never commit to source control — add to .gitignore, use env vars
• ❌ Never write into CI/CD YAML in plaintext — use your CI platform's secret store (GitLab CI Variables, GitHub Actions Secrets)
• ✅ One project, one token — don't share across projects; smaller blast radius on rotate
• ✅ Rotate immediately on suspected leak — the sooner the better; the lox_mcp_ prefix makes the token detectable by secret scanners (GitHub Secret Scanning, Gitleaks)
• ✅ Add lox_mcp_[A-Za-z0-9_-]{32,} to your CI secret scanner rules — auto-block accidental commits

The server does not store the plaintext token (same practice as GitHub PAT / Stripe API Keys, etc.), so a lost token can only be regenerated, not recovered.