Token format — Willo docs

Willo issues two kinds of token. Both are shown once, stored only as a hash, and can be revoked. See Agent tokens for how to create and manage one.

Format

willo_<prefix>_<public_id>_<secret><check>

Part	What it is
`prefix`	Three letters naming the kind of token.
`public_id`	16 lowercase letters and digits. Not secret: it is what the dashboard and logs show.
`secret`	52 lowercase letters and digits.
`check`	6 hex characters, a checksum, so a mistyped token is refused at once and a scanner can tell a real token from a look-alike.

Prefix	What it is
`willo_agt_`	Agent token: the bearer an outside AI agent sends to Willo's MCP server.
`willo_whk_`	Webhook token: the secret part of an Agent Program's webhook URL.

The exact shape of an agent token, as a regular expression. Use it in your own secret scanner.

^willo_agt_([a-z0-9]{16})_([a-z0-9]{52})([0-9a-f]{6})$