API tokens

API tokens are personal access keys that let integrations and scripts work with the system through its REST API, without signing in through the browser. Each token acts on your behalf, with your permissions.

Create a token when another system, such as an ERP or a reporting script, needs to read or update warehouse data automatically.

How to open API tokens

1. Click your name in the top bar.
2. Click My profile.
3. Select the API tokens tab.

The tab appears only if your role has the Use the API permission.

What’s on this screen

• The form to create a token.
• Your tokens — every token you created, with its name, abilities, when it was created, when it was last used (or Never used), when it expires (or Never expires), and a Revoke button.

How to create a token

1. Enter a Token name that tells you where it is used.
2. Under Abilities, tick Read, Write or both.
3. In Expires after, choose how long the token stays valid.
4. Enter Your current password.
5. Click Create token.
6. In Your new API token, click Copy and store the token in a safe place.

Caution

The token is shown only once. Copy it now; for your security it will not be shown again. If you lose it, revoke it and create a new one.

Fields

• Token name — required, up to 100 characters.
• Abilities — at least one. Read lets the token view data. Write also lets it create and change records through the API.
• Expires after — 7, 30, 90, 180 or 365 days, or a default or no expiry, depending on the system settings. Longer periods than the system maximum are not offered.
• Your current password — required to confirm that it is really you.

How to revoke a token

1. In Your tokens, click Revoke next to the token.
2. Confirm in the Revoke API token dialog.

Any integration using that token stops working immediately.

Note

Tokens do not ask for two-factor codes. Keep them secret and revoke any you no longer use. Tokens are revoked automatically when your account is deactivated.

Who can do this

You need the Use the API permission.