Tokens serve the HTTP API; outside agents connect over MCP with OAuth. A token is shown once: Nömad only keeps its fingerprint.
Personal tokens
nmu_live_v1_…, in your account › Developers. They act as you and inherit your role in each brand, never exceeding it.- Choose what it can read and what it can change per area (
works.read, kit.write…) and, if you like, which brands it reaches. It can always list its brands with brands.list. - Expiration: 7, 30 or 90 days (default), a year or the day you pick, and we let you know a week before. It can also have none: that is a risk if it leaks, so rotate it from time to time; you can revoke it whenever you want and a leak report revokes it at once.
Service accounts
- For what belongs to the organisation rather than a person (a store, an ERP, an automation): in the workspace › Developers an admin creates the account, gives it a role in all or some brands and issues it
nmw_live_v1_… tokens. - The account keeps working when whoever made it leaves; notices about its tokens reach whoever issued them.
- Disabling it revokes every token at once and removes its access to the brands.
Rotate, revoke and leaks
- Rotating creates a new secret with the same name, permissions and brands; the old one keeps working 0, 1, 24 or 168 hours so you can switch without downtime.
- Revoking cuts access on the next call. Every token records its last use.
- Store it as a secret, out of code. If it shows up where it should not, anyone can revoke it by sending it to
POST /api/credentials/revoke (body { "token": "…" }); the answer is the same whether it exists or not.
