Plan requirement
| Subscription | Any plan |
| Access | Admin |
API tokens let another system act as your account. Creating one is easy; managing them well is the part that matters.
Create a token
- Open Admin Center, then Apps and integrations, then API tokens.
- Add an API token.
- Give it a description saying what uses it.
- Copy the token now. It is shown once and never again.
- Save.
Write a real description
The field that saves you later. In two years you will look at six tokens and need to know which can be revoked. "Integration" tells you nothing; "Finance system, nightly contract sync, owner: Bram" tells you everything.
One token per integration
Sharing one token across three systems means revoking it breaks all three, and you cannot tell which one is making the calls that concern you. Separate tokens cost nothing.
A token acts as a user
It carries the permissions of the account it belongs to, so a token tied to an admin can do anything an admin can. Where the integration only needs to read tickets, tie it to an account with the narrower role rather than to yours.
A token is a password. Not in a shared document, not in a chat message, not in code that goes into version control. It grants access to every customer conversation you hold.
Revoke what you do not recognise
Review the list occasionally. A token whose purpose nobody can explain is either unused, in which case revoking costs nothing, or in use by something undocumented, which you need to know about.
Comments
0 comments
Article is closed for comments.