Settings subpage

Token & API Access

Review user upload tokens, API access posture, and safe token handling without exposing raw secrets.

Settings hubOpen user token dashboard

Token inventory

16 API tokens

Hashed tokens only are stored locally; full token values are shown once at creation and are never rendered here.

User access

19 users

Users create and revoke Hermes upload tokens from the dashboard. Owner review remains read-only from this subpage.

Operational posture

16 tracked tokens

Rotate stale credentials and keep owner/admin API calls protected by owner-token or authenticated session context.

Token safety checklist

  • Do not paste raw API tokens, owner tokens, auth secrets, or passwords into docs or commits.
  • Use the dashboard to create tokens and copy the secret only at creation time.
  • Revoke unused tokens before public demos or hosted handoff.