Usage data is a count per day and nothing else. No request paths, no IP addresses, no user agents, no per-request log rows. It cannot be mined for behaviour because there is nothing in it but integers.

Your token secret is not stored. Only a one-way hash of it is, salted with a key that never touches the database. Melodreams cannot show you a token again after you create it, and cannot recover one for you — not by support request, not by any means.

This page is never cached or indexed, sends no referrer, and can only talk to the Melodreams API.

Server-side only. A token in front-end JavaScript or a mobile app is a leaked token — anyone can read it. The API only permits browser requests from this console, so browser calls will fail by design.

Never commit a token. Read it from an environment variable or a secret manager.

One token per integration. Then revoking a compromised one doesn't take down everything else you built.

Revocation takes up to 30 seconds to apply everywhere. That delay is deliberate — it's what keeps authentication from hitting the database on every single request.