Access governance
Workspace ID and Token Setup Runbook
Turn ad-hoc credential setup into a controlled access workflow for teams running profile automation at scale.
Identifiers you must track
| Field | Purpose | Storage rule |
|---|---|---|
workspace_id |
Scope jobs to the correct team workspace | Config store; read-only in runtime logs |
user_id |
Trace execution ownership | Audit logs only |
token_version |
Track credential rotation | Secrets metadata — never plain logs |
profile_id |
Bind task lifecycle and cleanup | Job logs and evidence packs |
trace_id |
Correlate stages and incidents | Required on every batch |
Access provisioning sequence
- Confirm account role and workspace assignment for each operator.
- Capture
workspace_idanduser_idfrom a controlled UI or verified API response. - Issue a scoped token per environment; register
token_version. - Validate with a non-destructive API call; log
trace_id. - Move credentials into a secrets manager; revoke temporary copies.
Environment variable baseline
MLX_BASE_URL=http://127.0.0.1:35000
MLX_WORKSPACE_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
MLX_TOKEN=***
MLX_TOKEN_VERSION=v3
MLX_REQUEST_TIMEOUT_SEC=45
Expose only what runtime needs. Hide tokens from debug output and UI overlays.
Security guardrails
- Separate staging and production credentials.
- Rotate tokens after team access changes.
- Disable old token versions immediately after cutover.
- Log access events with immutable timestamps.
- Prefer 2FA on operator accounts (CLI 2FA guide).
Audit record skeleton
{
"trace_id": "access-2026-07-28-009",
"workspace_id": "948bab9a-2cad-4a3f-af1f-01bfe260f85b",
"user_id": "19047492-ea90-4138-9afc-d2df61de2b06",
"token_version": "v3",
"event": "access_validation",
"status": "pass",
"timestamp": "2026-07-28T12:00:00Z"
}
Common failures
| Mistake | Why it hurts |
|---|---|
| One token reused everywhere | One leak breaks every environment |
| Tokens in screenshots / chat | Uncontrolled sprawl; impossible rotation |
No token_version |
You cannot prove which credential was live during an incident |
| Shared “team” login | Breaks ownership and 2FA accountability |
When access is clean, continue with script runner or Postman setup. Need Multilogin itself? Partner codes live on the homepage.