About

Tokening is a small gateway that lets an AI agent do one job against your API without holding your API key. You issue a grant for the task: this post, these fields, one use, fifteen minutes. The agent gets the grant’s secret. Tokening keeps the real key, checks every call against the grant and writes down what it decided and why.

It exists because most APIs only offer broad keys. An agent asked to fix a typo usually ends up with a password that can delete the site. Prompt injection makes that worse. A page the agent reads can tell it to do something else, and nothing stands between that instruction and the API. A grant is that something.

Tokening is built for developers and small teams who run agents against their own WordPress sites, internal services and SaaS accounts, and who’d rather run one binary than adopt a platform. It’s one Go program with a SQLite file. It runs on Linux, macOS and Windows.

The name comes from the old meaning of a token: something you hand over that stands for permission, like a ticket or a claim check. Tokening is the act of giving a task its token. There’s no cryptocurrency here. More on the name.

Version 0.1 forwards MCP over HTTP and REST calls, keeps credentials in an encrypted vault, issues and revokes grants, and keeps an append-only decision log. The demo shows it on a throwaway WordPress. Next up: stdio MCP servers, grant requests that wait for a person to approve, and ready-made templates for GitHub, Stripe and Slack.

Tokening is open source under the Apache 2.0 licence and is a SoftDevStudio.com project. Code and manuals are on GitHub. Each release gets a project source review before it ships. That review is ours, not an outside security audit.