diff --git a/.agents/skills/token/SKILL.md b/.agents/skills/token/SKILL.md
new file mode 100644
index 000000000000..76c6bf3b6f06
--- /dev/null
+++ b/.agents/skills/token/SKILL.md
@@ -0,0 +1,38 @@
+---
+name: token
+description: Issue a fresh one-time pairing token to log into this self-hosted T3 Code prod server (15.204.108.12:7443), without restarting the service or disrupting other sessions. Use when the user says "/token", asks for a new login/pairing token, or their pairing link expired or was already consumed. Only runs on the T3 deploy host.
+---
+
+# Issue a T3 Code login token (prod)
+
+Issues a new single-use pairing token against the **live** prod database, without
+touching `t3code.service`. The logic lives in `token.sh` next to this file; your job
+is to run it and hand back the printed URL.
+
+## What the script does
+
+1. Guards that it's running on the actual T3 deploy host: checks the deploy checkout
+   (`~/projects/meta/t3code-v2`), the `t3code.service` unit, and the live state dir
+   (`~/.t3/userdata`) all exist.
+2. Runs the server's `auth pairing create` CLI directly against `~/.t3` (the same data
+   directory `t3code.service` is already serving from) with `T3CODE_PORT=3773`, so the
+   token lands in the running server's live database — no restart needed.
+3. Prints a ready-to-use `https://15.204.108.12:7443/pair#token=...` link.
+
+Unlike `/redeploy`, this never touches the running service — no session drop.
+
+## How to run
+
+```bash
+bash "$(git rev-parse --show-toplevel)/.claude/skills/token/token.sh" [ttl]
+```
+
+`ttl` is optional and defaults to `15m` (accepts anything the server understands, e.g.
+`5m`, `1h`, `30d`).
+
+## Handling the result
+
+- Report the pair URL and its expiry to the user directly in chat.
+- Treat it as a secret: don't put it in commit messages, screenshots, or any durable
+  log — it's a single-use bearer credential. Opening it twice, or in two different
+  browsers, consumes/invalidates it.
diff --git a/.agents/skills/token/token.sh b/.agents/skills/token/token.sh
new file mode 100755
index 000000000000..85ed180212a4
--- /dev/null
+++ b/.agents/skills/token/token.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# /token — issue a fresh pairing token for the T3 Code prod server
+# (t3code.service, fronted by Caddy on 15.204.108.12:7443) without restarting
+# anything. Writes a token directly into the running server's live database.
+set -euo pipefail
+
+DEPLOY_DIR="${T3_DEPLOY_DIR:-/home/dgordon/projects/meta/t3code-v2}"
+SERVICE="${T3_SERVICE:-t3code.service}"
+BASE_DIR="${T3_BASE_DIR:-$HOME/.t3}"
+SERVER_PORT="${T3_SERVER_PORT:-3773}"
+PUBLIC_URL="${T3_PUBLIC_URL:-https://15.204.108.12:7443}"
+TTL="${1:-15m}"
+
+# --- guard: only run on the actual T3 deploy/prod host ---
+if [ ! -e "$DEPLOY_DIR/.git" ]; then
+  echo "token: deploy dir '$DEPLOY_DIR' not found — this is not the T3 deploy host. Aborting." >&2
+  exit 1
+fi
+if ! systemctl --user cat "$SERVICE" >/dev/null 2>&1; then
+  echo "token: user service '$SERVICE' not found — this is not the T3 deploy host. Aborting." >&2
+  exit 1
+fi
+if [ ! -d "$BASE_DIR/userdata" ]; then
+  echo "token: base dir '$BASE_DIR' has no userdata/ — does not look like the live prod state dir. Aborting." >&2
+  exit 1
+fi
+
+export PATH="$HOME/.local/share/mise/shims:$DEPLOY_DIR/node_modules/.bin:$PATH"
+
+RESULT="$(cd "$DEPLOY_DIR" && T3CODE_PORT="$SERVER_PORT" node apps/server/src/bin.ts auth pairing create \
+  --base-dir "$BASE_DIR" \
+  --base-url "$PUBLIC_URL" \
+  --ttl "$TTL" \
+  --label "manual-login-$(date +%Y%m%d-%H%M%S)" \
+  --json)"
+
+PAIR_URL="$(echo "$RESULT" | jq -r '.pairUrl')"
+EXPIRES_AT="$(echo "$RESULT" | jq -r '.expiresAt')"
+
+echo "Pair URL (single-use, expires $EXPIRES_AT):"
+echo "$PAIR_URL"