Tokens and permissions

Tokens and permissions

The WorldAPI token is the limit: the agent sees only the tools the token's permissions allow. Give it the narrowest group that does the job. A smaller token also means a shorter tool list and faster answers.

Make a token

1. Join your server as an operator.
2. Run /worldapi token create agent, where agent is any name you like.
3. Click the groups you want in the chat.
4. Copy the token from the chat and put it into WORLDAPI_TOKEN.

WorldAPI's admin panel can make tokens too.

Pick a group

You want	Group	The agent can
Chat about the server, help new players, explore the API	viewer	Look: players, worlds, chests, stats, events, chat. 17 tools, none of them change anything.
Moderate	moderator	Also read the logs, look up commands, kick, ban, whitelist, teleport, and give items. 29 tools.
Run the server	admin	Everything but files and Java: the world, the console, restarts, tokens.
Edit configs	owner	Also change files and run Java. Treat it like SSH access, and give it only for that session.

For a public bot, a token without players:private hides coordinates, inventories, and chests.

Permissions in each group

Group	Permissions
viewer	server:read, players:read, players:private, events:read, chat:read
moderator	viewer, plus logs:read, commands:read, players:write, players:moderate
admin	Everything but files:write and code
owner	Everything

All permissions: server:read, players:read, players:private, events:read, chat:read, logs:read, system:read, world:write, players:write, players:moderate, server:console, commands:read, server:control, files:read, files:write, tokens:manage, code.

commands:read (WorldAPI 4.1) reads the command catalog for search_commands; a token with server:console reads it too. A server whose config lists its own groups adds commands:read where it wants it.

Without a token, the agent gets what WorldAPI's config lets anonymous visitors read: at most server:read, players:read, and events:read.

Next: Tools.