Tokens API
Personal access tokens are what authorize every REST and MCP call.
Personal access tokens are what authorize every REST and MCP call. They look like sbt_live_<id>_<secret> in production and sbt_test_<id>_<secret> everywhere else, and the plaintext value exists exactly once: in the response that created it.
You can mint one in the dashboard under Settings → API Tokens, or through the mint endpoint below. No token.* webhook events exist: mint and revoke are deliberately silent, because deliveries would let an observer fingerprint credential churn on an account they cannot otherwise see.
Background
Authorization
Ownership is necessary but not sufficient.
Changed in 3.0.0. These routes previously required no ability at all, on the reasoning that owning a token is the permission. It is not: a token scoped to nothing but
dashboard:readcould enumerate and revoke every other token its owner held, including the ones running their automation. Each route now demands its matchingtoken:*ability as well. If you have a token that reads analytics and also manages tokens, addtoken:view-any/token:deleteto it, or better, mint a separate one.
Tokens belonging to another user are invisible: every route returns 404 RESOURCE_NOT_FOUND for an id outside the caller's own set, so the API cannot be used to probe which ids exist.
Endpoints
/v1/tokensList the caller's tokensPOST/v1/tokensMint a tokenGET/v1/tokens/{token}Get a tokenDELETE/v1/tokens/{token}Revoke a tokenRelated
How is this guide?
Last updated on