Auth & join tokens

Tabbify uses different credentials for user access, control operations, MCP clients, and infrastructure joining the private mesh. They are deliberately not interchangeable.

Credential types

Credential	Used for	Boundary
Browser session	Web console	Authenticated account and tenant access
Deploy/API token	Selected REST and `tcli` operations	The network and permissions encoded when minted
MCP OAuth session or bearer token	Tools returned by MCP discovery	Authorized account, tenant, and published tool operations
Mesh join token	Admitting a supervisor or service peer	One tenant network and authoritative peer tags

Use the shortest-lived and narrowest credential that fits the workflow. Never place a deploy, MCP, or join token in a repository or application image.

Deploy and API tokens

Mint a network-scoped deploy token in the console under Deploy tokens. The value is shown once. Store it as TABBIFY_TOKEN in the GitHub Actions secret store or your local credential manager:

export TABBIFY_TOKEN="<network-scoped-token>"
tcli deploy --remote

The deployed OpenAPI document at https://api.tabbify.io/openapi.json identifies which REST operations accept the current bearer credential. Do not assume that one token authorizes every console action.

MCP authorization

Interactive MCP clients can use the OAuth flow discovered from https://api.tabbify.io/mcp. Headless clients can use a scoped bearer token. Authentication opens an MCP session; authorization is still evaluated for each discovered tool.

See Connect an MCP client for client configuration. Revoke the credential when an integration is removed.

Mesh join tokens

A mesh join token admits an infrastructure peer to one tenant network. Its network and tags are authoritative: a joining process cannot add privilege by passing different local --tag flags.

For the managed self-hosting flow:

Open the tenant network in the console.
Choose Add a node and mint the join token.
Pass it to the supported installer or join command.
Treat the value as a secret and discard it after the intended enrolment.

tabbify-mesh join \
  --name supervisor-01 \
  --join-token "$TABBIFY_JOIN_TOKEN"

The coordinator validates the token and returns only peers visible under the current ACL policy. A valid token provides mesh admission; it does not authorize public control API calls or application-level HTTP operations.

Revocation and rotation

Revoke deploy and MCP bearer credentials from the account token view. Join-token lifecycle and peer replacement are separate from application deployment. After rotating a credential, verify the exact client path rather than assuming every cached session has updated immediately.

Local development can run with explicit insecure flags, but those modes are not a production security claim. The managed mesh uses WireGuard encryption, join-token admission, and ACL-filtered visibility. Certificate coverage is not uniform across every platform hop, so applications must still authenticate sensitive requests.

For current mesh behaviour, see Private Mesh. For supported host enrolment, see Self-hosting.