Skip to main content
Dexi has two credential kinds, for two different jobs.

​
MCP connections (OAuth)

MCP clients never handle long-lived secrets. When a client first connects to https://mcp.dexi.net/mcp, it registers itself, opens your browser to a Dexi consent page, and receives short-lived tokens after you approve — the standard OAuth 2.1 flow, handled automatically by the client. Two scopes exist, and the consent page shows exactly what a client requested: Review and disconnect clients any time in Settings → Connected apps — revoking kills the client’s access immediately. Protocol details for client builders are on the OAuth page.

​
Personal API tokens

Tokens are minted in Settings → API tokens: 44 characters starting with dxi_, shown once at creation and stored hashed — copy it then or mint a new one. Up to 10 active tokens; revoke any of them from the same screen.
A token authenticates exactly one endpoint: POST /api/v1/bookmarks/save. That’s deliberate — tokens live in Shortcuts, scripts, and other places that leak, so a leaked token can add pages to your workspace but can never read, change, or delete anything in it. Full data access belongs to MCP connections, which you approve and revoke individually. Everything else under api.dexi.net is the Dexi app’s own session-authenticated API and isn’t usable with tokens.