A token on Platform is a configuration hanging off a data contract, so making one means publishing a contract.
Every token action is signed by an identity. Give its ID or its
.dash name — the key itself comes later, at the step that
signs. No identity yet? Onboard makes one.
Both spellings are stored on the contract and are what wallets and explorers will show. They cannot be renamed later.
The whole starting supply is created at publish time and lands on this identity. Decimals work like cents: 2 means the smallest piece anyone can hold is 0.01. Leave the maximum empty for no ceiling.
These three are settled at publish time and never move. Switching minting off now means the starting supply is the whole supply, for good.
Freezing makes someone else's balance unusable, so it is off unless you ask for it. Destroying a frozen balance is never switched on here. History is always kept — it is what makes the holder list below possible.
What you decided — decimals, supply, who may ever mint — is fixed the moment it lands. The contract cannot be changed and cannot be withdrawn.
Publishing a contract takes an AUTHENTICATION key at CRITICAL or HIGH. On a standard identity that is #2; keygen lays out all five and can add one that is missing. The key is used here to sign and is never stored or sent anywhere.
Which tokens exist comes from an indexer, because Platform cannot list them. The balances next to them are read from the chain.
Only for a token published with minting left on. A fixed-supply token already handed its whole supply to the issuer — there is nothing to add. Minting takes an AUTHENTICATION key at CRITICAL.
Moving a token takes an AUTHENTICATION key at CRITICAL. The TRANSFER key is CRITICAL too and cannot do it — that one only moves credits.
Platform cannot list holders: balances sit in a tree keyed by identity and nothing walks it. So this reads the token's history instead — every mint, transfer, burn and purchase — collects everyone who ever touched it, and looks up what each one has now. No key, and it works on any token, not only your own.