A member cannot give a script access to their own account #85

New Issue

2026-09-21T07:18:25Z

cgalo5758 commented

2026-09-21 07:18:25 +00:00

What a person cannot do today

Call the console from a script or another system on their own behalf. The only way in is the browser sign-in, so anything programmatic has to borrow a session cookie.

What they should be able to do

Mint a personal access token scoped to one of their workspaces, with a name and an expiry, revoke it, and use it in place of a session.

Why it matters

Any programmatic use, including the automation API the roadmap plans, needs a credential that is not a browser session.

Where

The authentication layer (a token store with hashed secrets, a middleware that accepts a token), the member's account page.

Done when

A token can be created, shown once, used against the routes that accept it, and revoked; the audit trail names the token that acted.

## What a person cannot do today Call the console from a script or another system on their own behalf. The only way in is the browser sign-in, so anything programmatic has to borrow a session cookie. ## What they should be able to do Mint a personal access token scoped to one of their workspaces, with a name and an expiry, revoke it, and use it in place of a session. ## Why it matters Any programmatic use, including the automation API the roadmap plans, needs a credential that is not a browser session. ## Where The authentication layer (a token store with hashed secrets, a middleware that accepts a token), the member's account page. ## Done when A token can be created, shown once, used against the routes that accept it, and revoked; the audit trail names the token that acted.

cgalo5758 added the

kind

enhancement

area/identity area/member-ui security labels 2026-09-21 07:18:26 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#85