Security & Auth

Two token types.

• Master token (MT_...) — backend only. Creates, refreshes, and revokes access tokens. Optional tenant_prefix and allow_ip_masks live in Cockpit JSON, not in the MT_... string.
• Access token (AT_{id}_{secret}) — given to clients. Carries tenant grants and optional network limits.

Start here:

• Tokens — format, TTL, refresh, revoke, how they are sent
• Permissions model — tenant grants and channel rules
• Threat model & best practices — least privilege, browsers, leaks

Related:

• Client configuration
• REST API
• Quickstart