## Token Management

### Current Auth Model
This server uses a static bearer token stored in `.env` as `MCP_BEARER_TOKEN`.
The token is validated on every request. Invalid or missing tokens receive
an HTTP 401 response with a `WWW-Authenticate` header (MCP spec compliant).

### Token Storage Rules
- Token lives in `.env` ONLY — never hardcoded in source
- `.env` is listed in `.gitignore` — never committed to GitHub
- `.env.example` contains the key name only, no value:
  ```
  MCP_BEARER_TOKEN=
  ```

### Token Rotation Procedure

Rotate the token any time you suspect exposure, or on a scheduled basis (recommended: every 90 days).

**Step 1 — Generate a new token**
Run this in your terminal to generate a secure random token:
```bash
python -c "import secrets; print(secrets.token_urlsafe(32))"
```

**Step 2 — Update .env in Codespaces**
```bash
# Open .env
nano .env

# Replace the value:
MCP_BEARER_TOKEN=<paste new token here>

# Save and exit: Ctrl+X → Y → Enter
```

**Step 3 — Update Fuelix**
- Go to your MCP server config in Fuelix (ideas.fuelix.ai or copilot settings)
- Update the bearer token to match the new value
- Save

**Step 4 — Restart the server**
```bash
# If running with uvicorn:
uvicorn main:app --host 0.0.0.0 --port 8000 --reload
```

**Step 5 — Verify**
```bash
# Test with new token — should return 200:
curl -H "Authorization: Bearer <new_token>" https://localhost:8000/health

# Test with old token — should return 401:
curl -H "Authorization: Bearer <old_token>" https://localhost:8000/health
```

**Step 6 — Confirm and close**
- Old token is now invalid
- No code changes needed — token lives in env only
- Document rotation date below

### Rotation Log

| Date | Rotated By | Reason |
|------|------------|--------|
| Aug 5 2026 | Pooven Pillay | Initial setup |
| | | |