diff --git a/backend/src/MoShiro.Backend.Application/Auth/AuthService.cs b/backend/src/MoShiro.Backend.Application/Auth/AuthService.cs
index 30cad19..cfc1ea2 100644
--- a/backend/src/MoShiro.Backend.Application/Auth/AuthService.cs
+++ b/backend/src/MoShiro.Backend.Application/Auth/AuthService.cs
@@ -140,7 +140,7 @@ public sealed partial class AuthService
             return ValidationError.Fail<CreatedApiToken>("scope", "must be read, admin or release");
         }
 
-        string plaintext = TokenHash.NewToken("mon");
+        string plaintext = TokenHash.NewToken("mos");
         var record = new ApiTokenRecord(Ulid.NewPrefixed("tok", _time), name, scope, TokenHash.Sha256(plaintext), _time.GetUtcNow().ToUnixTimeMilliseconds(), null, null);
         await _store.CreateApiTokenAsync(record, ct);
         return Result<CreatedApiToken>.Ok(new CreatedApiToken(record, plaintext));
diff --git a/backend/tests/MoShiro.Backend.Tests/ApiBasicsTests.cs b/backend/tests/MoShiro.Backend.Tests/ApiBasicsTests.cs
index 6774085..44f273c 100644
--- a/backend/tests/MoShiro.Backend.Tests/ApiBasicsTests.cs
+++ b/backend/tests/MoShiro.Backend.Tests/ApiBasicsTests.cs
@@ -139,7 +139,7 @@ public sealed class ApiBasicsTests
         Assert.Equal(HttpStatusCode.OK, read.StatusCode);
 
         using HttpClient bogus = _backend.NewClient();
-        bogus.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "mon_bogus");
+        bogus.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "mos_bogus");
         using HttpResponseMessage unknown = await bogus.GetAsync("/api/admin/agents");
         Assert.Equal(HttpStatusCode.Unauthorized, unknown.StatusCode);
     }