Authentication

The REST API and MCP server both authenticate with personal access tokens (PATs). There's no session-cookie option for programmatic access — every request needs a Bearer token in the Authorization header.

Personal access tokens

A PAT is a single string starting with the stc_ prefix, followed by 64 lowercase hex characters — 68 characters in total. Tokens are per-team, not per-user: any team member can use a token created by anyone else on the team, and any admin or owner can revoke any token.

There's no scope system yet — every token has full read and write access to everything on its team. There's no expiry either; revocation is the only way to invalidate a token.

Creating a token

From Settings → API → Tokens in the dashboard:

  1. Enter a name for the token (up to 100 characters, for example "CI pipeline") and click Create token.
  2. A dialog titled Your new API token shows the full token exactly once, with a warning: "You will not be able to see this token again. Copy it now." Click Copy to copy it to your clipboard, then Done to close the dialog.
  3. Store the token somewhere safe. Stector only keeps a hash of it — if you lose it, you'll need to create a new one.

After creation, the token list only ever shows the Name, a short Prefix (the first 12 characters, including stc_), Created date, and Last used time. The full token is never shown again.

Using a token

Send the token in the Authorization header on every request, as Bearer <token>:

curl https://api.stector.app/api/v1/teams/current \
  -H "Authorization: Bearer stc_..."

A request with no Authorization header, a malformed token, an unrecognized token, or a revoked token all return the same 401 Unauthorized response — Stector doesn't distinguish between these cases in the response body, so a leaked token attempt can't be used to confirm whether a guessed token ever existed.

Revoking a token

From the token list, click Revoke next to the token you want to disable. You'll be asked to confirm — a dialog naming the token and warning that "Integrations using it will stop working." Revocation is immediate and can't be undone; any request using that token starts failing with 401 Unauthorized right away. Only admins and owners can revoke tokens.