The REST API uses personal tokens, separate from the OAuth tokens your AI clients get. Each token belongs to one person and gives read access to that person’s inbox.
pst_ followed by 43 characters of base64url (32 random bytes). Anything else is rejected before LePosta looks it up.
Getting a token
During the private beta, tokens are issued by the LePosta admin with a command-line script, for an account that has already signed in to LePosta through MCP at least once. The token is shown once; LePosta keeps only its SHA-256 hash, so a lost token can’t be recovered, only replaced.
Ask the admin for a token, store it where only you can read it (for example ~/.config/posta/config.json with chmod 600), and tell them right away if it leaks.
Revocation and access
- A revoked token stops working on its next request.
- If your GitHub account is removed from LePosta’s allowlist, your tokens stop working immediately, even if they weren’t revoked.
- Each token records when it was last used (at most once per hour).
Never put a personal token in a posta. LePosta rejects postas that contain one, and it rejects them in every field.
