ACP auth and tokens
Two different secrets — do not mix them up.
ACP_SECRET
Bearer token that unlocks the cloud ACP endpoint itself. Without it, /acp returns 401. Set on the Railway acp service; clients send Authorization: Bearer …. Local stdio mode does not need this.
RIG_TOKEN
A personal developer token from Account → Security → Developer tokens. It starts with rig_at_, is shown once at creation, and is stored hashed. Required for devices, Mesh, and tickets. Public status/health work without it. You can also send X-Rig-Token on cloud requests, or type set token <rig_at_…> in an ACP chat.
Rotate
Rotate ACP_SECRET on Railway if a client key leaks. Revoke a developer token from Account → Security (same page you minted it) — that immediately stops ACP fleet calls using that token.