Managing access tokens

Some Experience Monitoring features require access tokens to work.

• System agents that monitor the health of a host server.
• Event markers plotted on charts using the API.
• Exporting data (using personal or organization API tokens).
• STM probes. The STM zone must have been created before creating the token.

Access tokens have moved to the Access tokens tab of each organization's page. Existing tokens have been migrated automatically and will continue to work without rotation.

Organization tokens and personal tokens

• Organization tokens are used when the action needs to keep running without a specific user. Only users with an Administrator role can create organization tokens.
• Personal tokens are linked to individual user rights. Users with a Member role can only create Read-only personal tokens.

Token permissions

Permissions are used for API tokens.

• Read-only: Retrieve data.
• Admin: Write on all public API endpoints.

Other types of tokens are automatically given a role called Push: writing is permitted only on a limited number of endpoints.

Creating an access token

1. Go to the correct page according to the type of token you want to create:

   • organization tokens: navigate to the organization's page, then select the Access Tokens tab.
   • personal tokens: click your user icon in the top-right corner, then click My Account.

2. Click the Create an access token button.

3. In the configuration window, enter a description that explains what the token will be used for, and a validity period. The list of tokens will show the first 4 characters of the token, followed by asterisks.

4. Enter or select all other relevant information:

   Type of token	Field
   Probe (STM zone)	STM zone that the token will allow to probe
   System agent	Site whose host machine will be monitored
   Data API (both organization and personal)	Scope (organization/site), Role (token permissions). Base your permissions on the principle of least privilege.
   Custom events (event markers)	Which site you want to plot event markers on Which custom icon you want your event marker to display.

5. Click Create an access token. The token is displayed in the Access token field. Copy it immediately: it is displayed only once. Once the window is closed, the secret cannot be retrieved, recovered, or displayed again. If a token is lost before it is securely stored in your integration environment, you must revoke the existing token and generate a new one.

Revoking an access token

Revoking a token is immediate and irreversible: it terminates all active sessions and API requests that use that token.

In the list of tokens, click the Revoke and delete icon associated with the token, then confirm the action. Any subsequent authentication attempts using the revoked token will result in a 401 Unauthorized response.

Security best practices

• Token rotation: update your tokens periodically.
• Scope minimization: use Read-only over Admin where possible.