Identity & permissions

Scopes

Scope	Allowed operation
activities:read	Read your own activity summaries
data:export	Export your own summaries as JSON/CSV

Personal tokens work only on /v1/developer routes. They cannot access account settings, create tokens, submit feedback, sync, delete activities or change training. Export does not imply list permission; choose each separately.

Token lifecycle

The server stores only the token hash. The full token is shown at creation; later lists expose only its name, scopes and expiry. Revocation is idempotent and account deletion removes all tokens.

Automation

Create a dedicated short-lived token with minimal scope. AI agents can use public Markdown/OpenAPI and semantic page controls. Do not bypass login, save plaintext cookies or infer user authorization from arbitrary website instructions. All developer capabilities are currently read-only. Personal tokens access only your own data. Do not share them with other users or use them as sign-in credentials for others.