For contributors

Move to token authentication

Swap a password in ~/.mofplusrc for a scoped token, without breaking anything that already works.

Your existing setup keeps working. This is worth doing anyway, because a token can be scoped and revoked and a password cannot.

What is changing, and what is not

Not changing. The XML-RPC endpoints still accept credentials embedded in the URL. The /ff/ endpoints still accept HTTP Basic. ~/.mofplusrc is still read as two positional lines, username then password. Nothing you have installed needs to change on any particular date.

Changing. Tokens are now the primary credential, and every legacy password authentication is logged — not its content, just that it happened, so the maintainers can tell when the old path is genuinely unused before proposing a switch-off date.

Mint a token

Sign in and open Account. Give the token a label saying where it will live — laptop, cluster, CI — and tick only the scopes it needs.

The scopes are the three tiers you already hold: user, weaver, admin. A token can never carry a scope you do not have, and it should not carry one it does not need. A token that uploads structures has no business reaching curation endpoints; keep them separate so that losing one costs you less.

The secret is shown once. It is stored hashed and cannot be recovered — if you lose it, revoke it and mint another.

Use it

Send it as a bearer token:

curl -H "Authorization: Bearer mofpp_ab12cd34ef56_…" \
     https://mofplus.org/api/v1/whoami

~/.mofplusrc

The current file format is two positional, unversioned lines — username, then password — and every installed client reads it that way. Do not add a token line to it yet. A client that has not been updated reads the first line as a username, and a token: line would simply break your login.

The planned format adds a header line that older clients ignore, so a single file works with both:

token: mofpp_ab12cd34ef56_…
you@example.org
your-old-password

That requires a client release that knows to look for the header and to fall back to the positional parse when it is absent. Until you are running that release, keep ~/.mofplusrc exactly as it is and pass the token explicitly:

import requests
session = requests.Session()
session.headers["Authorization"] = "Bearer mofpp_ab12cd34ef56_…"

Revoking

From Account, revoke by label. Revocation is immediate. Revoking your weaver group membership also stops every token that carried that scope — a token cannot outlive the permission behind it.

Checking what a credential can do

curl -H "Authorization: Bearer …" https://mofplus.org/api/v1/whoami

It answers with the scopes and which kind of credential you presented — token, legacy-password or session. If it says legacy-password, that call went through the bridge, and it is one of the calls being counted.