Agent tokens and security
How agent tokens are stored, limited and revoked.
A token is a long password for your coding agent. Treat it like any other password.
What a token is
- Tokens start with
coo_, followed by 32 characters. - Coohoo stores only a scrambled version of it, called a hash.
- That is why you see the token only once, when you create it.
What a token can do
A token acts as you, across your projects. Coohoo checks your membership on every call. An agent never reaches a project you cannot.
Limits
- You can have up to 10 active tokens.
- Each token can make 120 calls per minute.
If a token leaks
- Click your name, top right. A menu opens.
- Click Agent access. You see your list of tokens.
- Click Revoke next to the leaked token. It stops working at once.
- Click Create token to make a new one.
- Set up your agent again with the new token. See Connect an agent.
If something looks wrong
- You lost a token. It cannot be shown again. Revoke it and create a new one.
- You cannot create another token. You already have 10 active tokens. Revoke one you no longer use.
- The agent gets refused after many quick calls. Each token allows 120 calls per minute. Wait a minute and try again.
Tip: Never paste a token into a comment, a chat or a shared document, and if you do, revoke it straight away.