API Tokens

Overview

API tokens provide secure authentication to Transform APIs.

Use them for integrations, exports, and automations.

Key Concepts

• Token: secret string used for API authentication
• Scope: what a token can access (configuration dependent)
• Rotation: replacing tokens on a schedule to reduce risk
• Revocation: disabling a token immediately

How It’s Used

Use API tokens for system-to-system integration.

Use them for scheduled exports, data sync, and automated workflows.

Benefits

• Secure automation without interactive sign-in
• Improved auditability through controlled credential ownership
• Reduced operational risk through rotation and revocation

Setup Steps

1. Define the integration purpose and owner.
2. Create a token with a purpose-based name.
3. Store the token in a secrets manager.
4. Rotate and revoke tokens based on security policy.

Start here: Creating and Managing API Tokens

Best Practices

• Use least-privilege access for token creation and storage.
• Rotate tokens on a consistent schedule.
• Revoke unused tokens immediately after decommissioning.
• Record token ownership and purpose in a controlled location.

Summary

API tokens support secure integration and automation through controlled credentials.

Related:

• Creating and Managing API Tokens
• Security and Compliance

Overview

API token creation enables secure automation and integration.

Tokens should be treated as secrets and managed with rotation and revocation.

Key Concepts

• Token: secret credential used for API authentication
• One-time display: token values are often visible only at creation
• Rotation: replacing tokens on a schedule
• Revocation: disabling a token to stop access immediately

How It’s Used

Create tokens for integrations that require non-interactive access.

Rotate and revoke tokens as part of security governance.

Benefits

• Faster integration setup
• Reduced risk through controlled credential lifecycle
• Cleaner auditability for automation access

Setup Steps

Prerequisites:

• Admin access for developer settings
• A secrets manager for storage

1

Open API token settings

1. Navigate to developer settings.
2. Open API Tokens.

2

Create a token

1. Select Create token.
2. Name the token by purpose.

Use a name such as Analytics export — weekly or Integration — data sync.

3

Copy the token value once

1. Copy the token value.
2. Store the token in a secrets manager.

Tokens are often shown only once. Treat them like passwords.

4

Rotate or revoke

Rotate tokens on a schedule.

Revoke tokens you no longer use.

Common issue patterns:

API Tokens is not visible

This is usually a permissions issue.

Request access from an Account Admin for developer settings.

An integration starts failing

Common causes:

• Token was revoked
• Token expired (when token expiry is enforced)
• Token is used against the wrong Account or endpoint

Best Practices

• Use one token per integration purpose to isolate blast radius.
• Rotate tokens before planned cutovers and major releases.
• Remove tokens when the integration owner changes.

Summary

Token lifecycle management includes naming, secure storage, rotation, and revocation.

Related: API Tokens