API tokens

Open project API and choose Create New Token. The form provides Token Name and Permissions; the permission choices include Contributor, Developer, Editor, and Viewer.

Issue a credential

1. Give the token a name that identifies its integration and environment.
2. Select the smallest role that supports the intended work. Prefer Viewer for read-only integrations.
3. Store the issued value in the trusted application’s secret store.
4. Test a small permitted request and an operation that should be denied.

The current project form does not provide a space or expiry selector. Do not assume a token inherits all the issuer’s space grants. Test access to space-bound resources explicitly and use a supported access path when the required authority cannot be configured.

Rotate or revoke

Issue a replacement, deploy it to the intended consumer, verify requests, then revoke the previous credential through its management controls. Revoke a compromised token immediately and inspect relevant logs. Do not include the token value in a support request.

Team API controls and project tokens are different administrative contexts. Use project-specific credentials for the documented project data examples and consult the particular API contract before using a team credential.

See authentication and members and permissions.