diff --git a/README.md b/README.md
index a74657a..0e3f079 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ each driving a simple `step` activity.
 No build step required. Just install [Obelisk](https://obeli.sk/install/) and run:
 
 ```sh
+export OBELISK_API_TOKEN=$(obelisk generate token)
 obelisk server run --server-config server.toml --app-config app.toml --deployment deployment.toml
 ```
 
@@ -29,43 +30,52 @@ curl http://localhost:9090/parallel
 
 ## Inspecting executions
 
+The API port requires a token. The server above accepts the `OBELISK_API_TOKEN` exported before it
+started; export the same value in the shell you query from.
+
 List top-level executions (one per webhook call):
 
 ```sh
-curl -s "http://localhost:5005/v1/executions"
+export OBELISK_API_AUTH="Authorization: Bearer $OBELISK_API_TOKEN"
+curl -s -H "$OBELISK_API_AUTH" "http://localhost:5005/v1/executions"
 ```
 
-```
-E_01KN209P2PCVPGAPRC3DBAC92C  Finished(ok)  wasi:http/incoming-handler.handle  2026-03-31 13:11:01 UTC
-E_01KN208SQDTVW4ECBT1DPHAD03  Finished(ok)  wasi:http/incoming-handler.handle  2026-03-31 13:10:32 UTC
+```json
+[
+  {
+    "execution_id": "E_01KN209P2PCVPGAPRC3DBAC92C",
+    "ffqn": "wasi:http/incoming-handler.handle",
+    "pending_state": { "status": "finished", "result_kind": "ok", ... },
+    "created_at": "2026-03-31T13:11:01.541897881Z",
+    ...
+  }
+]
 ```
 
-Each line is: execution ID, state, FFQN (all webhooks use `wasi:http/incoming-handler.handle`), and creation time.
+Each entry has the execution ID, the FFQN (all webhooks use `wasi:http/incoming-handler.handle`),
+its state, and its creation time.
 
 Fetch logs for a webhook execution (includes its `console.log` output):
 
 ```sh
 EXECUTION_ID=E_01KN209P2PCVPGAPRC3DBAC92C
-curl -s "http://localhost:5005/v1/executions/${EXECUTION_ID}/logs"
+curl -s -H "$OBELISK_API_AUTH" "http://localhost:5005/v1/executions/${EXECUTION_ID}/logs"
 ```
 
-To see the child executions spawned by a webhook — the workflow and its activities — use
+To see the child executions spawned by a webhook, the workflow and its activities, use
 `show_derived=true`. Narrow to tutorial executions with `ffqn_prefix`:
 
 ```sh
-curl -s "http://localhost:5005/v1/executions?show_derived=true&ffqn_prefix=tutorial:demo"
+curl -s -H "$OBELISK_API_AUTH" "http://localhost:5005/v1/executions?show_derived=true&ffqn_prefix=tutorial:demo"
 ```
 
-```
-E_01KN209P2PCVPGAPRC3DBAC92C.o:1_1         Finished(ok)  tutorial:demo/workflow.serial   2026-03-31 13:11:01 UTC
-E_01KN209P2PCVPGAPRC3DBAC92C.o:1_1.o:2-step_1  Finished(ok)  tutorial:demo/activity.step 2026-03-31 13:11:01 UTC
-...
-```
+The CLI reads the same token, so `obelisk execution list` prints a compact summary.
 
 Then fetch logs for any individual execution by its ID. `console.log` calls in workflows
 and activities both appear as log entries.
 
-Open the **Web UI** at http://localhost:8080 for a visual trace of each execution.
+Open the **Web UI** at http://localhost:8080 for a visual trace of each execution. When it asks
+for authentication, paste the value of `$OBELISK_API_TOKEN`.
 Click an execution and enable **Autoload children** to see the full hierarchy
 of webhook → workflow → activities, with timestamps and structured log entries.
 
diff --git a/dev-deps.txt b/dev-deps.txt
index 0d04e61..f54db5b 100644
--- a/dev-deps.txt
+++ b/dev-deps.txt
@@ -2,8 +2,8 @@ cargo-edit-upgrade 0.13.13
 cargo-expand 1.0.126
 cargo generate 0.23.9
 just 1.58.0
-obelisk 0.42.0-rc.8
+obelisk 0.42.0-rc.10
 pkg-config 0.29.2
-rustc 1.97.1 (8bab26f4f 2026-07-14)
+rustc 1.98.1 (48a229cea 2026-09-01)
 wasm-tools 1.258.0
 ldd (GNU libc) 2.42
diff --git a/flake.lock b/flake.lock
index 33c7948..804ac2d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -47,11 +47,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790778165,
-        "narHash": "sha256-A+/YxUIpXNR0gKwfNh/n4AevrV7+WIDnIWdbu0AbON8=",
+        "lastModified": 1790882732,
+        "narHash": "sha256-seMpj1uobTuQPF8wovJXFS64zD6i08hKk4p3Jx5bCAU=",
         "owner": "obeli-sk",
         "repo": "obelisk",
-        "rev": "1be441569c54953b68503f61f26266cb0249f609",
+        "rev": "48b20c745a688916b9457bef91e30e10d12d59a7",
         "type": "github"
       },
       "original": {
diff --git a/rust/rust-toolchain.toml b/rust/rust-toolchain.toml
index 4cdff79..509dfd2 100644
--- a/rust/rust-toolchain.toml
+++ b/rust/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.97.1"
+channel = "1.98.1"
 targets = ["wasm32-unknown-unknown", "wasm32-wasip2"]
 components = ["rustfmt", "clippy", "rust-src", "rust-analyzer", "cargo"]
diff --git a/rust/server.toml b/rust/server.toml
index 429463a..7913040 100644
--- a/rust/server.toml
+++ b/rust/server.toml
@@ -1,4 +1,4 @@
-api.listening_addr = "127.0.0.1:5005"   # gRPC API server
+api.listening_addr = "127.0.0.1:5005"   # API server
 webui.listening_addr = "127.0.0.1:8080" # Web UI
 
 [log.console]