Access Tokens

Access tokens are credentials that authenticate API requests to the Autheona API. Every request your application makes to Autheona must include a valid access token in the authorization header.

How Access Tokens Work

When you create an access token, Autheona generates a unique credential associated with your account. This token:

  • Authorizes API requests to access your account resources
  • Can be revoked at any time through the platform
  • Cannot be recovered after creation (Autheona stores only a hashed version)

Access tokens are project-level credentials.

Token Types

Autheona provides a single token type that grants full access to all API endpoints within your account. There are no separate read-only or restricted tokens.

Creating an Access Token

To create a new access token:

  1. Click the Create Token button on the Access Tokens page
  2. A modal window appears with the following fields:
    • Expiration date - Review the default expiration date
    • Description - Add a meaningful description to identify the token purpose (e.g., "Production API key" or "Development testing")
  3. Click the token generation button to create the token

The platform generates the token and displays it in the modal.

Important

Copy the token immediately. You will not be able to view the full token value again.

Token Properties Cannot Be Modified

After creating a token, you cannot change any of its properties:

  • The expiration date cannot be extended or shortened
  • The description cannot be updated
  • The token value cannot be retrieved or regenerated

If you need different settings, revoke the token and create a new one.

Copying and Storing Tokens

After token generation, the complete token string appears at the bottom of the modal. Follow these steps to secure your token:

  1. Copy the token to your clipboard
  2. Store it in a secure location:
    • Use a password manager or secrets management tool
    • For applications, use environment variables (never hardcode tokens in source code)
    • For CI/CD pipelines, use secure variable storage

Warning

Once you close the modal, you cannot retrieve the token again. If you lose a token, you must revoke it and create a new one.

Token Management

ActionSupportedNotes
View token valueNoToken value is only displayed once at creation
Modify token propertiesNoAll properties are immutable after creation
Revoke tokenYesRevocation permanently disables the token
Regenerate tokenNoCreate a new token if you need a replacement

Revoking a Token

If a token is compromised or no longer needed, revoke it immediately:

  1. Locate the token in the Access Tokens list
  2. Click the revoke/delete action for that token
  3. Confirm the revocation

After revocation, any API requests using that token will fail authentication. This action cannot be undone.

When to Revoke Tokens

Revoke tokens in these situations:

  • Token was exposed in source code or logs
  • Token was shared with an unauthorized party
  • You are rotating credentials as a security best practice
  • An application using the token is decommissioned

Security Best Practices

  • Never share tokens - Each user or application should have its own token
  • Use descriptive names - Name tokens by their purpose so you can identify which to revoke if needed
  • Rotate regularly - Consider creating new tokens periodically and revoking old ones
  • Limit exposure - Use environment variables and secrets management, never commit tokens to version control
  • Monitor usage - Review API Usage regularly to detect unexpected activity