TokenService
TokenService is a VIEW-AND-REVOKE surface over the daemon's connector and share tokens: List reveals only fingerprints (never the secret bytes) and Revoke removes a token by its fingerprint or name. There is deliberately no mint RPC - minting is CLI-only, so the browser cannot create a durable credential.
Package magus.token.v1, defined in proto/magus/token/v1/token.proto. Part of the daemon API.
Methods
ListTokens
ListTokens returns every connector token plus the active share token (if any), each described by a prefix-only fingerprint - never the secret bytes.
POST /magus.token.v1.TokenService/ListTokens - unary.
Takes ListTokensRequest, returns ListTokensResponse.
RevokeToken
RevokeToken removes a connector token or the share token by identifier. Revoking the share token also closes its LAN listener. The cli token is not revocable here.
POST /magus.token.v1.TokenService/RevokeToken - unary.
Takes RevokeTokenRequest, returns RevokeTokenResponse.
Messages
ListTokensRequest
No fields.
ListTokensResponse
| Field | Type | # | Description |
|---|---|---|---|
tokens |
repeated TokenInfo | 1 |
RevokeTokenRequest
| Field | Type | # | Description |
|---|---|---|---|
identifier |
string | 1 | identifier is a token name or fingerprint (as returned in TokenInfo.identifier). |
RevokeTokenResponse
| Field | Type | # | Description |
|---|---|---|---|
token |
TokenInfo | 1 |
TokenInfo
TokenInfo describes one manageable token WITHOUT its secret, minimized to exactly what a view+revoke UI needs. A read-only list is still an intelligence surface - names, timing, and expiries let a viewer fingerprint the deployment - so it carries ONLY: a short revoke handle (identifier, the prefix-only fingerprint, never the token bytes or the full hash), the token class (scope), the expiry, and the user-chosen name (the operator needs the name to know which token to revoke). It deliberately omits the raw secret, the full hash, any filesystem path, the creation time, and every other internal storage detail: none is needed to revoke, all would help a viewer map the infrastructure.
| Field | Type | # | Description |
|---|---|---|---|
name |
string | 1 | connector name, or a label for the share token |
identifier |
string | 2 | prefix-only fingerprint; the Revoke key |
scope |
TokenScope | 3 | |
expires |
Timestamp | 5 | unset means the token never expires |
Enums
TokenScope
TokenScope names the CLASS a token belongs to in the three-tier credential model, so a client can group and label listed tokens - and so the full taxonomy is named in one place even for the class this service never lists. A connector token is a full MCP bearer minted for an external client; a share-read token is the short-lived, read-only secret behind "share to phone"; the operator token is the built-in cli credential.
| Value | # | Description |
|---|---|---|
TOKEN_SCOPE_UNSPECIFIED |
0 | |
TOKEN_SCOPE_OPERATOR |
3 | TOKEN_SCOPE_OPERATOR is the built-in cli token: auto-seeded on first daemon start, the bootstrap "god" credential that authenticates the operator to the daemon. It is managed SOLELY by the CLI and is structurally invisible+immutable to this service - it lives in a store this handler never opens, so it can be neither listed nor revoked here and this value therefore NEVER appears in a ListTokensResponse. It exists in the enum to name the class, not because the wire ever carries it. |
TOKEN_SCOPE_CONNECTOR |
1 | |
TOKEN_SCOPE_SHARE_READ |
2 |