Access Tokens

Access tokens are credentials that authenticate API requests to the Autheona API. Every request your application makes to Autheona must include a valid access token in the authorization header.

Token Types

Autheona provides two types of access tokens, each designed for specific use cases:

Private API Key (Access Token)

The Private API Key is your primary access token for server-side API calls.

Characteristics:

• Required for the User Trust API
• Used for server-to-server communication
• Provides complete API functionality

Public API Key

The Public API Key is designed for client-side usage in browsers and frontend applications.

Characteristics:

• Required for the Fingerprint API
• Safe to use in browser-based JavaScript
• Limited to fingerprint generation only
• Cannot access sensitive account data

Token Type Comparison

How Access Tokens Work

When you create an access token, Autheona generates a unique credential associated with your account. This token:

• Authorizes API requests to access your account resources
• Can be revoked at any time through the platform
• Cannot be recovered after creation (Autheona stores only a hashed version)

Access tokens are project-level credentials.

Creating an Access Token

To create a new access token:

1. Click the Create Token button on the Access Tokens page
2. A modal window appears with the following fields:
   • Expiration date - Review the default expiration date
   • Description - Add a meaningful description to identify the token purpose (e.g., "Production API key" or "Development testing")
3. Click the token generation button to create the token

The platform generates the token and displays it in the modal.

Token Properties Cannot Be Modified

After creating a token, you cannot change any of its properties:

• The token type cannot be changed
• The expiration date cannot be extended or shortened
• The description cannot be updated
• The token value cannot be retrieved or regenerated

If you need different settings, revoke the token and create a new one.

Copying and Storing Tokens

After token generation, the complete token string appears at the bottom of the modal. Follow these steps to secure your token:

1. Copy the token to your clipboard
2. Store it in a secure location:
   • Use a password manager or secrets management tool
   • For applications, use environment variables (never hardcode tokens in source code)
   • For CI/CD pipelines, use secure variable storage

Storing Public API Keys

Public API keys can be stored differently since they are safe for frontend exposure:

• Include directly in JavaScript code
• Store in configuration files
• No additional security measures required

Token Management

Revoking a Token

If a token is compromised or no longer needed, revoke it immediately:

1. Locate the token in the Access Tokens list
2. Click the revoke/delete action for that token
3. Confirm the revocation

After revocation, any API requests using that token will fail authentication. This action cannot be undone.

When to Revoke Tokens

Revoke tokens in these situations:

• Token was exposed in source code or logs (Private API Keys)
• Token was shared with an unauthorized party (Private API Keys)
• You are rotating credentials as a security best practice
• An application using the token is decommissioned

Security Best Practices

For Private API Keys

• Never share tokens - Each user or application should have its own token
• Never expose in frontend - Private keys must only be used server-side
• Use descriptive names - Name tokens by their purpose so you can identify which to revoke if needed
• Rotate regularly - Consider creating new tokens periodically and revoking old ones
• Limit exposure - Use environment variables and secrets management, never commit tokens to version control
• Monitor usage - Review API Usage regularly to detect unexpected activity

For Public API Keys

• Use only for Fingerprint API - Public keys have limited permissions
• Safe for frontend - Can be included directly in browser code
• Don't worry about key exposure - Keys cannot access sensitive account data