Token and AI agent security

An API token (bbx_pat_…) is a key to your account: whoever has it can do, from anywhere, everything its permissions allow, until you revoke it. This article covers the rules for using tokens and AI assistants connected through MCP safely, and the steps to take if a token has reached someone else. You manage your tokens on the “Token-uri de acces (API)” (Access tokens (API)) page (blackbox.md/account/api-tokens, “Contul meu” (My account) → “Token-uri API” (API tokens)).

Available to: the owner of a blackbox.md account who uses, or wants to use, an AI assistant through MCP.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

The rules in brief

Grant the minimum permissions

• Start with the three read permissions, which are checked by default in the “Token nou” (New token) card: “Citește lista și statusul serverelor mele” (Read the list and status of my servers), “Citește soldul, facturile și comenzile” (Read the balance, invoices and orders) and “Citește lista cheilor mele SSH” (Read the list of my SSH keys). They are enough for questions about your servers, balance and invoices.
• Create a separate token with red permissions (the five shown in red) only when you want the assistant to manage your servers. The “AI-administrator — acces complet” (AI administrator — full access) button checks all eight permissions: then uncheck whatever the task at hand does not need.
• Do not check “Plasează și modifică comenzi în numele meu” (Place and change orders on my behalf) (orders:write) unless the assistant needs to spend money: with it, the assistant places orders and pays for them from your balance, performs upgrades and cancels orders.
• A token's permissions cannot be expanded after it is created. When you need more, create a new token and revoke the old one.

What each permission allows: Token permissions (scopes). Which permissions a given task needs: Example tasks for the AI assistant and the permissions they need.

Risk “Vizualizează parolele/accesul serverelor” (View server passwords/access) (servers:credentials) and “Rulează orice comandă ca root pe serverele mele” (Run any command as root on my servers) (servers:exec) mean root access to every server you manage from your account. The token is not tied to a computer or an IP address: if it reaches someone else, it works from anywhere until you revoke it.

One token per client and device

1. Create a separate token for each AI client and each device. In “Nume token” (Token name), enter a clear name, for example “Claude Desktop (laptop)” or “Cursor (office)”.
2. Check the table on the “Token-uri de acces (API)” (Access tokens (API)) page regularly. The “Ultima utilizare” (Last used) column shows when each token was last used, or “niciodată” (never); it updates at most once a minute.
3. For tokens you no longer use or do not recognize, click “Revocă” (Revoke) and confirm with “Revocă” in the “Revocați token-ul?” (Revoke the token?) window. Access stops immediately.

No email is sent when a token is created or revoked, so the list on this page is the only place where you can see your tokens. Detailed steps: API tokens: creating, copying and revoking.

How to replace a token periodically

Tokens do not expire, and the page does not let you set an expiration date. Replace them periodically, and also whenever you change devices or when someone who has seen the token no longer works with you.

1. In the “Token nou” (New token) card, create a token with a new name and the same permissions as the old one (the “Permisiuni” (Permissions) column shows them as codes, for example servers:read).
2. Copy it with “Copiază” (Copy) (it is shown only once) and put it in your AI client in place of the old one.
3. Ask the assistant to call whoami. If the new token works, the response shows its permissions (scopes) and the ones it is missing (missing_scopes).
4. On the old token's row, click “Revocă” (Revoke) and confirm.

Where to keep the token

• Put the token directly in your AI client's settings, in a password manager or in an environment variable.
• Do not paste it into conversations (not even the one with your AI assistant), screenshots, emails or support tickets, not even for BLACKBOX support.
• Do not write it in files that end up in a git repository. If the configuration file lives in your project, use an environment variable. For example, in Claude Code's .mcp.json file:

{
  "mcpServers": {
    "blackbox": {
      "type": "http",
      "url": "https://api.app.blackbox.md/mcp",
      "headers": {
        "Authorization": "Bearer ${BBX_PAT}"
      }
    }
  }
}

The token is stored in the BBX_PAT environment variable, not in the file. Settings for each client: Connecting from Claude Code, Cursor, VS Code and other clients.

If the token has ended up in a git repository anyway, revoke it. Deleting the file or the commit is not enough: the repository history keeps it.

What the AI provider sees

Everything the MCP tools return reaches the AI client and the provider that runs the model: the server list and IP addresses, your balance and invoices, the output of commands run on the server and, with servers:credentials, the root password and the private SSH key that BLACKBOX issues for the assistant. The assistant is instructed not to show secrets in the conversation unless you ask for them, but they reach the model anyway.

• Use an AI provider you trust, and read its terms on data retention.
• If you don't want a root password the assistant has seen to remain valid, reset it when you finish working: Resetting the root password.

Approving actions in your AI client

The BLACKBOX MCP server marks the tools that change something or reveal secrets, so that your AI client asks for your approval before running them. However, the approval prompt is shown by the AI client, not by BLACKBOX. If you choose automatic approval (“always allow”, auto-run or a similar option, depending on the client), the confirmations disappear.

The assistant is instructed to ask for your consent only before spending money (placing and paying for an order, an upgrade), canceling an order, deleting an SSH key from the server, disabling password login and replacing the agent key. It is instructed to do everything else (commands on the server, installations, reboots, root password resets, adding SSH keys) directly, without asking. For these actions, the client's approval prompt is the only check.

When you use MCP from your own code (through AI providers' APIs), no approval prompt appears: the tools run as soon as the model calls them, unless you have programmed a confirmation yourself. In that case, use a read-only token or limit the allowed tools: Using MCP from code (AI APIs and HTTP).

Warning Do not turn on automatic approval for tools that spend money or change your servers. These confirmations protect your balance and your data. For example, canceling an order with an active server deletes the server immediately, along with all its data.

Hidden instructions in content (prompt injection)

An AI assistant follows instructions written in text. Content from a source you don't control (a web page, a log file, an email, a file from someone else's project, even the output of a command) can contain instructions planted there by someone else. This way, an assistant with servers:exec or servers:credentials can be tricked into running commands as root or passing on passwords.

• Do not use a token with red permissions in a session where the assistant browses the web, reads emails or processes files received from others.
• Read every command before you approve it. Stop if the assistant proposes something you did not ask for: downloading and running a script from the internet, adding an SSH key or a user, sending data to an unknown address, or showing passwords.
• After the assistant has read logs or web pages, check the commands it proposes even more carefully.

How the assistant reaches your server

The assistant does not need your root password or your SSH key. BLACKBOX keeps a management key on every VPS server, shown in the app.blackbox.md panel as “Management key (blackbox.md)” in the “Installed keys” list. Commands run through run_server_command go through this BLACKBOX connection as root. That is why a token with servers:exec is all someone needs to run commands on your servers. Details: BLACKBOX keys on your server.

• You stop the assistant's access by revoking the token, not by deleting the management key. Without that key, panel features such as “Reset password” stop working too.
• With servers:credentials, the assistant can receive the root password or its own private SSH key (the agent key, with the comment blackbox-agent-…). These remain valid even after you revoke the token, until you reset the password or delete the key from the server.

If a token has reached someone else

1. Revoke the token: “Contul meu” (My account) → “Token-uri API” (API tokens) → “Revocă” (Revoke) on its row, then confirm with “Revocă”. The client that was using it loses access on its next request.
2. If you don't know which token leaked, stop all of them at once by changing your blackbox.md account password (not the panel password): “Contul meu” → “Profil” (Profile) → “Schimbă parola” (Change password). Tokens created before the change stop working, but they stay in the list without any marker, so revoke them too. Steps: Changing your account password.
3. Look at the token's “Permisiuni” (Permissions) and “Ultima utilizare” (Last used) columns. If it was used after you lost it, run the checks in the table below.
4. Create new tokens only for the AI clients you keep using.
5. Write to us at support@blackbox.md or open a ticket (Opening a support ticket). Include the token's name and the time shown in “Ultima utilizare”, but not the token itself.

If you still use SSH access through AI after deleting the blackbox-agent-… key, ask the assistant for a new key with regenerate=true; otherwise the old key is reinstalled. Details: SSH access and SSH keys through the AI assistant.

Important If you created your account with Google or GitLab, it has no password on blackbox.md: the “Profil” page has no “Parolă” (Password) section, and step 2 cannot be done. In that case, revoke each token with “Revocă”.

Responsibility for tokens

Under the Terms and Conditions (§3), you are responsible for securing your passwords, SSH keys, API tokens and second authentication factor. Whatever an AI assistant or anyone else does with your token is done on behalf of your account, including payments from your balance. BLACKBOX is not liable for third parties' use of your account unless there is a proven breach of its own systems. Summary of the terms: Terms and conditions in brief.

Frequently asked questions

Does signing out of blackbox.md stop my tokens? No. Neither signing out, nor “Sign Out Everywhere”, nor changing the password in the panel affects your tokens. Only “Revocă” (Revoke) and changing your blackbox.md account password stop them.

I accidentally pasted my token into the conversation with the assistant. What should I do? The conversation reaches the AI provider and may remain in the client's history. Create a new token, put it in the client and revoke the old one.

Do I need to send my token to support so they can look into a problem? No. For troubleshooting, the token's name, its permissions and the error message from your AI client are enough.