Posts a pack of BMB SVGs directly onto a real Miro board — same logic
as bmb draw <pack> <board> from the CLI.
Stored in localStorage on this device only — never sent
anywhere except as an X-Miro-Token header on the actual
draw call, where the server uses it for the request and drops it.
It is not stored in any cookie, log, or k8s secret.
boards:read and
boards:write.
Prefer the OAuth dance? See the official Miro OAuth docs . BMB's web UI uses the simpler personal-token flow for v1.
Tokens expire. Personal tokens have been moving toward 60-day refresh — if a draw fails with 401, regenerate. BMB never sees your token outside of the in-flight request.
Idle — pick a pack, then dry-run or draw.