Authentication and token scopes

Browser session

The web app uses the signed-in account session for private screens and settings. Mutating browser requests are checked against the configured site origin. Do not copy browser cookies into scripts or agents.

Create a least-privilege token

In the signed-in app, open Settings → Tokens (/settings/tokens). Enter a name, optionally restrict the token to one project, choose an expiry from 1 to 365 days, then select only the needed permissions. Create the token and copy the secret immediately: it is shown once. Save it in a secret manager or protected environment variable, never source control. The active-token list shows scopes, project, last use and expiry; revoke the token there when it is no longer needed. This describes the UI only; no token is created by following these docs.

Each new permission is opt-in. Existing tokens do not gain newly added scopes. Project-scoped tokens can only act within that project; whole-account permissions such as account:read, account:write and account:export require an unscoped token.

• projects:read — Read projects and history.
• updates:read — Read updates and desk.
• drafts:write — Create and edit drafts; rebuild history.
• updates:publish — Publish checked drafts and enable automatic publishing.
• tokens:manage — Manage API tokens.
• projects:write — Create, edit and delete projects; manage chapters.
• sources:read — Read source connections and configuration.
• sources:write — Configure sources, disconnect and refresh verification.
• voice:read — Read writing voice and examples.
• voice:write — Edit voice, import examples and generate voice previews.
• account:read — Read account settings, notifications and billing status.
• account:write — Edit account settings, notifications and follows.
• account:export — Export all account data.

Limits

The server enforces ownership and scopes for each operation. Following-feed access needs updates:read. CLI and MCP authenticate with bearer credentials and cannot supply the IndieLogs browser session. Operations marked signed-in session only therefore require the web app. OAuth grants, billing checkout and portal actions, provider consent and account deletion remain browser-session flows. Consult the generated per-operation reference before choosing a client.