Engine Token

Our Commitment MountDev Ops is built security first. Your business data belongs to you, and you can export all of it at any time. We never use analytics or tracking of any kind inside MountDev Ops.

Your workspace has its own engine token. It proves a call comes from your workspace and from no other. Only owners can make, rotate, or revoke it.

Make the Token

Select the Settings gear, then Connections, then Engine Token (owners only; action core.engine_token.create). The token is shown once, with Copy. Copy it then: it is never shown again, to anyone, because only a fingerprint of it is kept. Your workspace also keeps a sealed copy that only it can open.

A workspace has one token at a time. To get a new one, rotate it.

Rotate the Token

Rotate (action core.engine_token.rotate) makes a new token. The old token stops working at once, with no grace period. The new token is shown once.

Revoke the Token

Revoke (action core.engine_token.revoke) stops the token at once. You can make a new one at any time.

What You See

Status (action core.engine_token.status) shows whether the workspace has a working token, its last 4 characters, and when it was made, rotated, or revoked. It never shows the token.

What Is Kept

• Your workspace: the token, sealed with your company's own key, plus a one-way fingerprint of it (to check calls) and its last 4 characters. All of it stays in your workspace, in your data region.
• The workspace directory (the lookup of where each workspace runs): nothing from the token, not even the fingerprint.
• Nothing is kept in the code, in a log, or in the Activity Log. Each change is written there as "made", "rotated", or "revoked" the engine token, never the token.

Good to Know

• A token for one workspace is never accepted for another.
• AI agents and API keys cannot make, rotate, or revoke a token.
• The older shared key keeps working alongside the tokens for now, and is retired in a later release.