--- title: Ghostwriter v7: Safer Tokens, Scoped Access, and Better... description: Ghostwriter v7.0.0 overhauls its authentication model by replacing user-managed JWT API tokens with opaque, hashed credentials (prefixed gwat_) and introducing... canonical: https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation | daily.dev og:description: Ghostwriter v7.0.0 overhauls its authentication model by replacing user-managed JWT API tokens with opaque, hashed credentials (prefixed gwat_) and introducing... og:url: https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef og:image: https://api.daily.dev/og/posts/Hi7IHaXEf.png og:image:alt: Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation **[SpecterOps](https://daily.dev/sources/specterops)** · 6 min read · 0 upvotes · 0 comments ## Summary Ghostwriter v7.0.0 overhauls its authentication model by replacing user-managed JWT API tokens with opaque, hashed credentials (prefixed gwat_) and introducing scoped service tokens (gwst_) for non-human integrations. Service tokens carry their own permissions rather than inheriting a user's, enabling narrowly scoped access such as single-operation-log read/write or read-only project access. Editing a token's expiry now rotates the token entirely, invalidating the old credential. The release also improves the profile UI for managing tokens and opens safer paths for LLM-assisted workflows against the platform. Users upgrading must rotate existing tokens to receive new opaque credentials, and the release is available as of June 3, 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in Ghostwriter v7 regarding API token authentication? Ghostwriter v7.0.0 replaces user-managed JWT API tokens with opaque credentials called Ghostwriter Access Tokens, identified by a gwat_ prefix and backed by hashed secrets. Token validation checks the secret against stored hashes and rejects revoked, expired, or inactive-user tokens. Editing a token's expiry now rotates its prefix, secret hash, and UUID, immediately invalidating the old credential. Existing tokens must be rotated after upgrading. _daily.dev helps teams track breaking authentication changes like this before an upgrade goes wrong._ ### What are scoped service tokens in Ghostwriter v7 and how do they differ from user API tokens? Scoped service tokens, prefixed gwst_, are opaque credentials tied to service principals rather than individual users, introduced in Ghostwriter v7.0.0. Their permissions are assigned directly to the token instead of inherited from a creating user, allowing narrow grants such as read/write access to a single operation log or read-only access to selected projects. This makes them safer for non-human integrations like LLM-assisted automation than full user-bound tokens. _Developers designing scoped, auditable integrations can follow security releases like this on daily.dev._ ## Similar posts on daily.dev - [Ghostwriter v7.3.0: A Fresh New Look](https://daily.dev/posts/ghostwriter-v7-3-0-a-fresh-new-look-er72byykx) · SpecterOps · 0 upvotes · 0 comments - [Modernize Datadog API authentication with scoped credentials](https://daily.dev/posts/modernize-datadog-api-authentication-with-scoped-credentials-hqg9vowte) · Datadog · 0 upvotes · 0 comments - [Notice about upcoming new format for GitHub App installation tokens](https://daily.dev/posts/notice-about-upcoming-new-format-for-github-app-installation-tokens-639qmlcxz) · GitHub Changelog · 1 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation","url":"https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef"},"datePublished":"2026-08-23T12:16:30.981Z","dateModified":"2026-10-14T02:22:36.640Z","description":"Ghostwriter v7.0.0 overhauls its authentication model by replacing user-managed JWT API tokens with opaque, hashed credentials (prefixed gwat_) and introducing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c139634fc25a34b14c85a0b27b5b65b8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c139634fc25a34b14c85a0b27b5b65b8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation-hi7ihaxef#faq","mainEntity":[{"@type":"Question","name":"What changed in Ghostwriter v7 regarding API token authentication?","acceptedAnswer":{"@type":"Answer","text":"Ghostwriter v7.0.0 replaces user-managed JWT API tokens with opaque credentials called Ghostwriter Access Tokens, identified by a gwat_ prefix and backed by hashed secrets. Token validation checks the secret against stored hashes and rejects revoked, expired, or inactive-user tokens. Editing a token's expiry now rotates its prefix, secret hash, and UUID, immediately invalidating the old credential. Existing tokens must be rotated after upgrading. daily.dev helps teams track breaking authentication changes like this before an upgrade goes wrong."}},{"@type":"Question","name":"What are scoped service tokens in Ghostwriter v7 and how do they differ from user API tokens?","acceptedAnswer":{"@type":"Answer","text":"Scoped service tokens, prefixed gwst_, are opaque credentials tied to service principals rather than individual users, introduced in Ghostwriter v7.0.0. Their permissions are assigned directly to the token instead of inherited from a creating user, allowing narrow grants such as read/write access to a single operation log or read-only access to selected projects. This makes them safer for non-human integrations like LLM-assisted automation than full user-bound tokens. Developers designing scoped, auditable integrations can follow security releases like this on daily.dev."}}]} ```