Scripts, and an app or CLI you signed in by pasting, use this token. It is shown once; regenerating it signs out whatever holds the old one. Devices signed in through the browser keep their own tokens.
Devices
Each sign-in through the browser (cocoonbox login) has its own token with your whole account. Revoke one you no longer use; the others stay signed in.
Client
Device
Signed in
Last used
Signing out everywhere ends this console session, every other one, the personal token, every device and every agent's access at once. Boxes, shares and connected accounts stay.
Settings
Boxes
Name
Box
State
Image
Sharing
A share link shows the box's whole desktop, including the browser's signed-in sites and /workspace, to anyone who holds it, or only to the users you name. Their own agents can connect over MCP: read-only, with files only under /workspace, or acting on the box when you allow write. Box egress uses your model key; a guest's own agent spends the guest's quota. With write, programs a guest runs in the box can use your keys on their hosts, as your own can.
Box
Who
Write
Expires
Guests' agents use the MCP endpoint with the header below.
Model usage
Model
Requests
Tokens
Cost (USD)
Sign-in methods
Connect GitHub to sign in with it instead of your password. Only a GitHub account you connect here signs in to this account; an email address never links one.
Provider
Email
Connected
Password
Delete my account
Deleting your account releases your boxes, deletes their saved state, your keys and your connections, and signs out every device. It cannot be undone.
Users
User
Id
Made by
Token
Max boxes
Cap
Running at once
Agent boxes
Daily model cap (USD)
Status
Create a user
Signup
Queue
#
Email
GitHub login
Status
Since
Invites
Invite
Uses left
Expires
Made by
Invite tokens
An invite token only makes one-use invites that last at most 7 days (cocoonbox invite create) and lists the invites it made; every other call refuses it. It stops when you revoke it, or when you stop being an admin.