Implement a dedicated, secure mechanism to generate, rotate, and revoke access tokens used by AI agents (such as Hermes Agent). Tokens are currently extracted via XML views, creating a security risk when passed through third-party API relays or model providers. Native generation paired with lifecycle controls like instant rotation and revocation will prevent credential leaks and ensure secure agent access.
I realised the token generated via the XML views is still valid even after revoking the corresponding sessions in the Plex Web UI. I don’t understand why would this happended.
Then I tried the method described in Authenticating with Plex , it works but this could be encapsulate as a user-friendly Web UI interaction.
Fine-grained access token will be more helpful. I may create a read-only token or a token for a specific scope of library.
