diff --git a/src/grist_mcp/logging.py b/src/grist_mcp/logging.py
new file mode 100644
index 0000000..42fb090
--- /dev/null
+++ b/src/grist_mcp/logging.py
@@ -0,0 +1,11 @@
+"""Logging configuration and utilities."""
+
+
+def truncate_token(token: str) -> str:
+    """Truncate token to show first 3 and last 3 chars.
+
+    Tokens 8 chars or shorter show *** for security.
+    """
+    if len(token) <= 8:
+        return "***"
+    return f"{token[:3]}...{token[-3:]}"
diff --git a/tests/unit/test_logging.py b/tests/unit/test_logging.py
new file mode 100644
index 0000000..fbc5e55
--- /dev/null
+++ b/tests/unit/test_logging.py
@@ -0,0 +1,24 @@
+"""Unit tests for logging module."""
+
+from grist_mcp.logging import truncate_token
+
+
+class TestTruncateToken:
+    def test_normal_token_shows_prefix_suffix(self):
+        token = "abcdefghijklmnop"
+        assert truncate_token(token) == "abc...nop"
+
+    def test_short_token_shows_asterisks(self):
+        token = "abcdefgh"  # 8 chars
+        assert truncate_token(token) == "***"
+
+    def test_very_short_token_shows_asterisks(self):
+        token = "abc"
+        assert truncate_token(token) == "***"
+
+    def test_empty_token_shows_asterisks(self):
+        assert truncate_token("") == "***"
+
+    def test_boundary_token_shows_prefix_suffix(self):
+        token = "abcdefghi"  # 9 chars - first to show truncation
+        assert truncate_token(token) == "abc...ghi"