Security
Write tokens
Write tokens let an agent build, publish, and manage your Games through MCP.
Overview
A write token is a bearer credential for MCP clients such as Claude Code, Cursor, and Codex CLI. The client sends it as Authorization: Bearer miradock_mcp_… on every request to https://miradock.com/mcp. Clients that support OAuth, such as Claude.ai, can connect with OAuth instead.
| Property | Behavior |
|---|---|
| Format | miradock_mcp_ followed by 64 hex characters (32 random bytes) |
| Storage | MiraDock stores only a bcrypt hash of the token and shows it in full once, at creation |
| Display | The app identifies a token by its label and the first 8 characters after the prefix |
| Scopes | mcp:read and mcp:write |
| Expiry | Tokens you create at /app/mcp do not expire; revoke them when you stop using them |
Generating tokens
Create write tokens in the Your tokens section of /app/mcp. Give each token a label that names the client or device, then copy it immediately: MiraDock only shows the full token once.
Token scope
A write token acts as your account. It can call every current MCP tool: read the Game SDK spec, validate, publish and update Games, configure leaderboards, Store SKUs, and tips, read stats, and report issues. It can only change Games you own, and it is subject to the same rate limits as the rest of your account.
Anonymous sandbox tokens issued to agents before sign-up are more limited until the sandbox is claimed; see Connecting an agent.
Rotation
- Create a new write token in /app/mcp.
- Update the agent or MCP client configuration with the new token.
- Confirm the client can call a tool, for example
get_game_sdk_spec. - Revoke the old token once the new one works.
Revocation
Revoke tokens from /app/mcp. Every later request with a revoked token is rejected with HTTP 401, so the agent loses access on its next call.
What to do if a token leaks
- Go to /app/mcp and revoke the leaked token.
- Create a replacement token for the affected client.
- Update the client configuration outside of chat or shared documents.
- Check your Games for changes you did not make.
Other token formats
MiraDock still accepts read-only MCP tokens and a small set of older token prefixes so existing clients keep working. Read-only tokens can call read tools but not tools that change Games. New tokens always use the current format.