API access & tokens
Anything that isn’t a browser signs in with a personal access token (PAT) — scripts against the REST API, token-based MCP clients like Claude Code, and the Premiere panel.
Creating a token
Section titled “Creating a token”Mint tokens on your account page. Two rules to know:
- The full token is shown exactly once, at creation. Copy it then — afterwards only a short identifying prefix is ever displayed. Lose it, mint a new one.
- Tokens can be renamed and revoked from the same page at any time. Revocation is immediate.
Using a token
Section titled “Using a token”Send it as a bearer credential:
Authorization: Bearer <your token>That works against the REST API and the MCP endpoint
(https://hypeflow.m1au.com/mcp) alike. For claude.ai, prefer the
OAuth connector — no token handling at all.
Treat it like a password
Section titled “Treat it like a password”A token acts as you — your projects, your organizations. Accordingly:
- One token per tool (“premiere-panel”, “render-script”) — so revoking one doesn’t break the others, and the name tells you what leaked if one does.
- Never commit a token to a repo or paste it into a shared doc.
- A deliberate safety property: a token cannot be used to mint further tokens — managing tokens always requires a real browser session.