Create an API token only when an admin asks for one

[om986]

Summary

• Signing in no longer reveals an API token. The console session is enough for the UI.
• An admin creates a token from the account header, or with om token create --email. The value is shown once. om token rotate --email replaces it.
• Migration 007 drops the stored plaintext preview and clears tokens that were never shown. A token that was already copied keeps working.

Test plan

• Run om migrate, then sign in. The console should not show a token banner.
• Click Create API token, copy the value, dismiss the banner, and reload. The banner stays hidden and the button reads Rotate API token.
• Confirm rotation, and check that the previous token no longer calls /v1.
• Run om token create --email you@example.com and use the printed value as Authorization: Bearer. A second create should refuse and point at om token rotate.
• Add another admin and confirm they get a temporary password, not an API token.

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5ca1ca8b-6340-44f7-b263-82e0f763c546

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}