Feature
Tokens and scopes
Every request needs a bearer token tied to a principal and limited by scopes.
Tokens carry the sbus_ prefix, last at most 90 days and can be revoked. A principal that is disabled stops all its tokens.
bus:read covers inbox and list_sessions; bus:write covers register, send, broadcast, ack and unregister. The scope is checked before any tool runs: 401 without a valid token, 403 for a wrong scope.
Raw tokens are redacted from logs, which carry the token id only. The supported client setups keep the token out of ~/.claude.json and off the command line.