Remove token from client

README.md

@@ -28,12 +28,9 @@ go build -o luxtools-client .
 ./luxtools-client
 ```
 
-On startup, if you don’t pass `-token`, the server generates a random token and prints it to the logs. Put that token into the Dokuwiki plugin configuration.
-
 ### Flags
 
 - `-listen` (default `127.0.0.1:8765`): listen address (`host:port`). Must be loopback.
-- `-token` (default empty): shared secret token. If empty, a token is generated and logged at startup.
 - `-allow` (repeatable): allowed path prefix. If you specify one or more, the requested path must start with one of them.
 
 Examples:
@@ -42,9 +39,6 @@ Examples:
 # Listen on a different local port
 ./luxtools-client -listen 127.0.0.1:9000
 
-# Use an explicit token (recommended for stable config)
-./luxtools-client -token "your-shared-secret"
-
 # Restrict opens to your home directory (repeat -allow as needed)
 ./luxtools-client -allow "$HOME"
 ```
@@ -53,7 +47,6 @@ Examples:
 
 The scripts below install (or update) the client as a service that starts automatically with the system.
 They assume the client binary already exists in the same folder as the scripts.
-During install/update, the scripts prompt you for the shared token (press Enter to keep the current token, if already configured).
 
 ### Linux (systemd)
 
@@ -79,7 +72,7 @@ Uninstall:
 ./uninstall-linux.sh
 ```
 
-Keep token/config on uninstall:
+Keep config on uninstall:
 
 ```bash
 ./uninstall-linux.sh --keep-config
@@ -89,7 +82,7 @@ Notes:
 
 - Installs to `~/.local/share/luxtools-client/luxtools-client`
 - Creates a systemd *user* unit at `~/.config/systemd/user/luxtools-client.service`
-- Stores config (including the token) in `~/.config/luxtools-client/luxtools-client.env`
+- Stores config in `~/.config/luxtools-client/luxtools-client.env`
 
 ### Windows (Scheduled Task at logon)
 
@@ -116,7 +109,7 @@ Uninstall:
 uninstall-windows-task.bat
 ```
 
-Keep token/config on uninstall:
+Keep config on uninstall:
 
 ```bat
 uninstall-windows-task.bat --keep-config
@@ -125,18 +118,11 @@ uninstall-windows-task.bat --keep-config
 Notes:
 
 - Installs to `%LOCALAPPDATA%\luxtools-client\luxtools-client.exe`
-- Stores config (including the token) in `%LOCALAPPDATA%\luxtools-client\config.json`
+- Stores config in `%LOCALAPPDATA%\luxtools-client\config.json`
 - Re-running the install script updates the EXE in place and restarts the task.
 
 ## API
 
-### Auth
-
-Requests must include the token using the `X-Luxtools-Token` header.
-
-- Header: `X-Luxtools-Token: <token>`
-- For `GET /open`, a `token=...` query parameter is also accepted as a fallback.
-
 ### `GET /health`
 
 Returns JSON:
@@ -164,7 +150,6 @@ Example:
 ```bash
 curl -sS -X POST \
   -H 'Content-Type: application/json' \
-  -H 'X-Luxtools-Token: your-shared-secret' \
   --data '{"path":"/tmp"}' \
   http://127.0.0.1:8765/open
 ```
@@ -177,7 +162,6 @@ Example:
 
 ```bash
 curl -i \
-  -H 'X-Luxtools-Token: your-shared-secret' \
   'http://127.0.0.1:8765/open?path=/tmp'
 ```