Access tokens

Most people never need to create an access token. This page explains the exception: when you need a raw token (oat_…) instead of the default browser login, and how to manage one safely.

The default: just log in

On a laptop or desktop, you almost certainly don't need this page. Run:

npx originai login

That stores a user-level token in ~/.origin/settings.json, and the CLI, the Claude Code plugin (originai mcp), and local MCP configs all use it automatically. No copying or exporting required.

When you actually need an access token

Scenario	What to use
An interactive machine	`npx originai login`
CI or a headless runner	Create a token, then set `ORIGIN_TOKEN=oat_…` as a secret
A remote-only HTTP MCP host that can't run stdio	`ORIGIN_TOKEN` plus a remote MCP config
A token that may have leaked	Revoke it in Settings and create a new one

Creating and using a token (CI / advanced)

In the app, open Settings → Access tokens.
Click Create, and copy the value immediately — it's shown only once at creation, and typically starts with oat_.
Set it in your CI or remote host environment:
```
export ORIGIN_TOKEN=oat_…
```
If a token might be exposed, revoke it and create a replacement.

You'll know it's working when npx originai list-projects (or list-documents) succeeds, and you've kept the token out of Git.

Security notes

The server stores a hash of the token, not the raw value. A lost token can't be recovered — only rotated.
Tokens are scoped to your user account. The project binding lives in .origin.json, not inside the token itself.
Never put a token in a client-side public environment variable or a committed .env file.

Common questions

Question	Answer
Is this a Supabase JWT?	No — origin-api authenticates by matching a hash of your access token.
Does Claude Code need `ORIGIN_TOKEN`?	No — the plugin uses `originai mcp` after you log in.
Do tokens count against my AI turns?	No — turns apply only to the in-app agent.
Can agents write forever?	After the first release, writes stage a change request instead of mutating the workspace.