API tokens
What the bundle in your ERP, the proxy workers you deploy, and your own automations authenticate with.
API tokens are the credentials used by everything that talks to the archive without a person behind it: the bundle installed in your ERP, the proxy workers you deploy, and any automation of your own.
Reading the list
| Column | What it tells you |
|---|---|
| Token | The token name and its prefix. The secret itself is shown once, at creation. |
| Scopes | What the token is allowed to do. |
| Status | Active, Expired or Revoked. |
| Last used | When it last authenticated. |
| Expires | When it stops working. |
| Created | When it was made, and by whom. |
Scopes
Scopes seen on tokens include Admin, Platform bundle, Read only and Proxy worker. A token can carry more than one. The scope set is what separates a token that only reads from one that can administer.
A proxy worker needs the proxy worker scope, not Admin. Scoping down is the difference between a leaked token being an incident and being a nuisance.
Status
| Status | Meaning |
|---|---|
| Active | Working now. |
| Expired | Past its expiry date and no longer accepted. |
| Revoked | Withdrawn deliberately, before expiry. |
Revoked and expired tokens stay in the list rather than disappearing, so you can still see what existed and when it was last used.
Creating and revoking
New token creates one. Active tokens carry a Revoke action, which takes effect immediately.
Copy the token when it is created. It cannot be retrieved afterwards, only revoked and replaced.
Seeing what a token did
Every access made with a token appears in the Access log with the token as the actor, provided recording is switched on. Tokens appear there as an Api token actor, separately from users and share links.