> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leposta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Personal tokens for LePosta's REST API: format, how they are issued and stored, and how to keep them safe.

The REST API uses **personal tokens**, separate from the OAuth tokens your AI clients get. Each token belongs to one person and gives read access to that person's inbox.

```http theme={null}
GET /api/postas HTTP/1.1
Host: mcp.leposta.com
Authorization: Bearer pst_EXAMPLE000000000000000000000000000000000000
```

## Format

`pst_` followed by 43 characters of base64url (32 random bytes). Anything else is rejected before LePosta looks it up.

## Getting a token

During the private beta, tokens are issued by the LePosta admin with a command-line script, for an account that has already signed in to LePosta through MCP at least once. The token is shown **once**; LePosta keeps only its SHA-256 hash, so a lost token can't be recovered, only replaced.

Ask the admin for a token, store it where only you can read it (for example `~/.config/posta/config.json` with `chmod 600`), and tell them right away if it leaks.

## Revocation and access

* A revoked token stops working on its next request.
* If your GitHub account is removed from LePosta's allowlist, your tokens stop working immediately, even if they weren't revoked.
* Each token records when it was last used (at most once per hour).

> [!WARNING]
>
> Never put a personal token in a posta. LePosta rejects postas that contain one, and it rejects them in every field.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.