API Tokens
Generate and manage API tokens for server-side operations within a specific workspace.
What are API Tokens?
API tokens allow your server-side code to authenticate with a specific workspace to:
- Authenticate API requests
- Register new users via the API
- Perform management operations without OAuth flows
Viewing Tokens
- Go to syauth.com/dashboard
- Select a Workspace
- Click Tokens in the sidebar
- View your API tokens for that workspace
Creating a Token
- Click Create Token
- Configure the token:
| Field | Description | Required |
|---|---|---|
| Name | Token identifier (e.g., production-api) | ✅ |
| Scope | Permissions (default: read write) | ❌ |
- Click Create Token
- Important: Copy the token immediately - it's shown only once!
Using API Tokens
API tokens are used to authenticate your application when registering new users:
curl -X POST https://api.syauth.com/e/v1/register/ \
-H "X-API-Key: your_token_here" \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]", "password": "SecurePass123!"}'
Note: API tokens are for Application API endpoints (like registration), not for the Developer Management API. Developer endpoints are only accessible via the SyAuth Dashboard.
Token Scopes
| Scope | Description |
|---|---|
read | Read-only access to resources |
write | Create and update resources |
| (empty) | Full access to all operations |
Example scope values:
read- Read-only tokenwrite- Create/update onlyread write- Both read and write access- (leave empty) - Full access
Token Security
| Practice | Description |
|---|---|
| Never expose in frontend | Tokens are for server-side only |
| Use environment variables | Don't hardcode tokens |
| Rotate regularly | Create new tokens periodically |
| Revoke unused tokens | Delete tokens no longer needed |
Revoking a Token
- Find the token in the list
- Click Delete
- Confirm deletion
Note: Revocation is immediate. Any requests using this token will fail.
Token Details
The token list shows:
| Column | Description |
|---|---|
| Name | Token identifier |
| Scope | Permissions (read, write, or empty for full access) |
| Created | When the token was created |
| Last Used | Last time the token was used (or "Never") |
| Status | Active or Revoked |
Best Practices
| Practice | Description |
|---|---|
| One token per service | Easier to revoke if compromised |
| Descriptive names | production-api, ci-cd-pipeline |
| Monitor usage | Review last-used dates |
Next Steps
- API Reference - Use tokens with the API
- Security Best Practices - Secure your tokens