Access tokens

An access token authenticates a machine against one project. Agent sessions and direct API calls use one. CI should not: in GitHub Actions, use the OIDC exchange for a 1-hour token per run instead of storing anything.

Scope

The project is the scope. There is no scope string to compose: a token acts on the one project it was minted for and cannot read another project in the same workspace or change workspace membership.

Minting one

From the console, in project settings:

console.extension.dev/<workspace>/<project>/settings/access-tokens

Or through device login, below, when the machine should never see a pasted secret.

extension.dev hosts the device flow itself, following RFC 8628. Run extension_auth with action: "login" from an agent, or the package bin directly:

bash

npx @extension.dev/mcp login --project <workspace>/<project>

The CLI or agent prints a user code and points you at:

www.extension.dev/device

Open that page in a browser signed in to extension.dev and approve the code. The platform mints a project scoped token and writes it to the local token store. GitHub is federated server side, so no GitHub token ever reaches your machine and there is no github.com step in the flow.

Lifetime

One to seven days, chosen at mint time. The default and the maximum are both seven, and the server enforces the cap: a token that leaks stays useful for days, not forever.

WARNING

A seven day maximum means a pipeline with a hardcoded token starts failing within a week. That is the point. CI belongs on the OIDC exchange, which mints a 1-hour token per run and stores nothing.

Transport

The Authorization header only:

bash

export EXTENSION_DEV_TOKEN=...
curl -s -X POST https://www.extension.dev/api/cli/stores/submit \
  -H "Authorization: Bearer $EXTENSION_DEV_TOKEN" \
  -d '{"browsers":["chrome"],"buildSha":"<sha>","channel":"stable"}'

The MCP server reads the same variable. The API refuses a token in a query string with a named error, so a token never lands in a request log by accident.

Revocation

Revoke from the Access tokens page or with DELETE /api/projects/{id}/access-tokens/{tokenId}. Revocation is immediate: the server tracks every live token, and a valid signature alone is not enough to pass.

Logging out locally does not revoke the token. It removes the local copy and nothing else. If a token may have leaked, revoke it from the console.

What a token cannot do

Read store credentials. The platform holds them and never returns them
Read another project
Outlive seven days
Travel in a query string

Access tokens ​

Scope ​

Minting one ​

Device login ​

Lifetime ​

Transport ​

Revocation ​

What a token cannot do ​

Next ​