# Token format

> The shape of a Willo agent token and webhook token, the scopes, the expiry choices and the pattern secret scanners match.

Generated from Willo's code at each release.

Source: https://www.willo.ai/docs/reference/tokens

Willo issues two kinds of token. Both are shown once, stored only as a hash, and can be revoked. See [Agent tokens](https://www.willo.ai/docs/ai-agents/agent-tokens) for how to create and manage one.

## Format

```
willo_<prefix>_<public_id>_<secret><check>
```

| Part | What it is |
| --- | --- |
| `prefix` | Three letters naming the kind of token. |
| `public_id` | 16 lowercase letters and digits. Not secret: it is what the dashboard and logs show. |
| `secret` | 52 lowercase letters and digits. |
| `check` | 6 hex characters, a checksum, so a mistyped token is refused at once and a scanner can tell a real token from a look-alike. |

## Prefixes

| Prefix | What it is |
| --- | --- |
| `willo_agt_` | Agent token: the bearer an outside AI agent sends to Willo's MCP server. |
| `willo_whk_` | Webhook token: the secret part of an Agent Program's webhook URL. |

## Agent tokens

| Property | Value |
| --- | --- |
| Scopes | `act` (read + act), `read` |
| Expiry choices | 30 days, 90 days, 365 days |
| Default expiry | 90 days |
| Live tokens per business | 20 |
| Label length | 60 characters |

## Secret scanning pattern

The exact shape of an agent token, as a regular expression. Use it in your own secret scanner.

```
^willo_agt_([a-z0-9]{16})_([a-z0-9]{52})([0-9a-f]{6})$
```