Access tokens

Creating, listing, renaming and revoking tokens needs a second factor you used in the last 30 minutes. If you have not confirmed one recently, the page says Confirm it is you to see this page and offers a button; confirm with a passkey or an authenticator code. On a session you opened with a passkey, Other ways to confirm also offers your Account password. An account with only a password cannot manage tokens until it adds a second factor: see Security and passkeys.

An account that an organization manages (a managed identity) cannot create personal access tokens: the page says Your organization manages this account, so this is not available here. Ask your organization’s administrator. and the organization's directory connection is its only way in.

A token acts inside one of your organizations. You need at least one that is active. If you have none, the New token page says No organization to act in and asks you to accept an invitation to one first. See Organizations.

The page describes tokens as letting a script read and update your own profile through the account API, and notes that each token expires on the date you choose, or never if you choose that. The list is titled Your access tokens, with these columns:

Inactive means the token is otherwise valid but you are no longer an active member of the organization it belongs to. A token never allows more than you could do yourself at that moment, so it is refused while you do not have that access.

1. New token.
2. A token's name, with its status badge, here Active.
3. Revoke all tokens, which appears while you have at least one active token.

1. Name.
2. Organization, the one the token acts in.
3. The Access level, with the Scopes below it.
4. Create token.

Scopes#

The scopes are grouped by area: Profile, Sessions, Devices, Organizations, Security settings and Access tokens. Each area has Read and Change (for example identity.self.profile.read and identity.self.profile.write). Sessions, Devices and Access tokens also have single actions: Sign out a session, Remove a device, Create an access token and Revoke an access token. Read only ticks every Read scope and Full access ticks every scope, actions included. Ticking anything else switches the level to Custom.

Today only your own profile is reachable with a token (see Using an access token), so the other scopes are choices you can make ahead of the API accepting them.

You must tick at least one. A token can only carry access that you yourself hold in that organization, so the platform refuses a scope you do not have.

Allowed IP addresses#

Leave the box empty and the token works from any address. Otherwise, enter up to 16 entries, one per line. Each entry is a single address or a CIDR block such as 203.0.113.0/24. IPv4 and IPv6 are accepted. A single bad entry rejects the whole list, so a typo cannot quietly widen the restriction. A token used from an address outside the list is refused.

The secret is shown once#

After you create the token the page is titled Token created and shows Copy your token now. It says this is the only time the secret is shown, that it is not stored and cannot be shown again. The secret is in a field labelled Token secret, with buttons to show it, hide it and copy it. Select I have copied it when you are done and you return to the list.

If you leave the page without copying the secret, it is gone. Revoke that token and create another.

Treat the secret like a password. Anyone who has it can use the access you gave it, within its scopes, expiry and address list. Keep it in a secret store, not in source code or a chat.

Creating a token sends a security alert email to your verified addresses, and adds an event to your notifications.

1. Token secret, hidden until you select Show.
2. Show and Copy.
3. I have copied it, which returns you to the list.

Rename opens a dialog with Token name. Enter a new name of up to 100 characters and select Save name. The name is a label for you only. Revoked tokens have no actions.

The dialog says anything using the token stops working straight away. A revoked token stays in the list marked Revoked and cannot be revived.

Revoke all tokens#

Revoke all tokens, at the top right, appears while you have at least one active token. Its dialog is titled Revoke every token? and says every active token stops working straight away. Confirm with Revoke all tokens. Closing your account also revokes every token, and so does the No, secure my account choice on a sign-in alert.

• Using an access token
• Connected apps: applications you allowed to sign you in.
• Sessions and tokens