diff --git a/plugins/data-inspector/src/cli.ts b/plugins/data-inspector/src/cli.ts
index 3cfc572e..85ae668c 100644
--- a/plugins/data-inspector/src/cli.ts
+++ b/plugins/data-inspector/src/cli.ts
@@ -17,7 +17,7 @@ import process from 'node:process'
 import { fileURLToPath } from 'node:url'
 import { cac } from 'cac'
 import { createDevServer } from 'devframe/adapters/dev'
-import { DEVFRAME_CONNECTION_META_FILENAME } from 'devframe/constants'
+import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_META_FILENAME } from 'devframe/constants'
 import { serveStaticNodeMiddleware } from 'devframe/utils/serve-static'
 import { getPort } from 'get-port-please'
 import pkg from '../package.json' with { type: 'json' }
@@ -103,7 +103,7 @@ export function createDataInspectorCli() {
         })
       })
       await new Promise<void>(done => server.listen(port, flags.host, done))
-      const url = `http://${flags.host}:${port}/${token ? `?di_token=${token}` : ''}`
+      const url = `http://${flags.host}:${port}/${token ? `?${DEVFRAME_AUTH_TOKEN_QUERY_PARAM}=${token}` : ''}`
       console.log(`data-inspector attached to ${websocket}`)
       console.log(`open ${url}`)
     })
diff --git a/plugins/data-inspector/src/spa/composables/rpc.ts b/plugins/data-inspector/src/spa/composables/rpc.ts
index 6f432a33..3d9761f7 100644
--- a/plugins/data-inspector/src/spa/composables/rpc.ts
+++ b/plugins/data-inspector/src/spa/composables/rpc.ts
@@ -26,6 +26,7 @@ import type {
   SuggestOutcome,
 } from '../../engine'
 import { connectDevframe } from 'devframe/client'
+import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM } from 'devframe/constants'
 import { reactive, shallowRef } from 'vue'
 import { runQuery, runQueryAtPath, skeletonOf, suggest as suggestQuery } from '../../engine'
 
@@ -163,14 +164,15 @@ function createStaticBackend(dataset: StaticDataset): DataBackend {
 
 /**
  * Read and strip the pre-shared auth token the attach CLI appends to the SPA
- * URL (`?di_token=…`), so it never lingers in the address bar or history.
+ * URL (`?devframe_auth_token=…`), so it never lingers in the address bar or
+ * history.
  */
 function consumeAuthToken(): string | undefined {
   const params = new URLSearchParams(location.search)
-  const token = params.get('di_token')
+  const token = params.get(DEVFRAME_AUTH_TOKEN_QUERY_PARAM)
   if (!token)
     return undefined
-  params.delete('di_token')
+  params.delete(DEVFRAME_AUTH_TOKEN_QUERY_PARAM)
   const search = params.toString()
   history.replaceState(null, '', search ? `?${search}` : location.pathname)
   return token