Skip to main content

Issue API tokens

Create API tokens in the Console. Always set an expiration date.

  1. In the target site, open Settings → API Tokens and select Create Token.
  2. In Create API Token, enter Name and Expiration, then create a token with a clear rotation owner and finite expiry.
  3. Copy the plaintext token at creation time and store it immediately in a secret manager. The plaintext is shown once and cannot be retrieved later.
  4. Record the token name, purpose, owner, and expiry without recording the token value.
  5. List tokens periodically and review expiry and ownership.

If the one-time plaintext was dismissed, create a replacement with a new finite expiry, store it immediately, update and test every consumer, then revoke the old token when possible.

Confirm token revocation
  • Affected resource and cascade: Confirm the token name, owner, and consumers that use it.
  • Reversibility: Revoke Token permanently invalidates the token.
  • Authorization: Confirm the target site and that you are allowed to make this change.
  • Backup or export: Note who owns the token and how you'll replace it; never save the token value.
  • Confirmation: Confirm the exact token in the revoke dialog.
  • Success response and postcondition: Verify the token disappears and a reuse attempt fails.
  • Recovery: Create replacement → store immediately → update/test consumers → revoke old token when possible.

If revocation fails, prior validity is unchanged and the token may already be expired; investigate before assuming access was removed. Select Revoke Token only after completing these controls.

A token inherits the user's current permissions; it does not have independent per-token scopes. Revoking a token returns 200 OK; check that the token no longer appears in the list afterwards.

For unresolved token outcomes, see troubleshooting.