An API token is the credential a program uses to access veilx's API. With one, you can automate everyday operations with scripts — managing sites in bulk, purging caches, reading usage — without logging into the console each time.
What a token is
A token represents your account identity, carried with each API request so the server can confirm "who is calling and with what permissions". It's effectively a key, so keep it safe and grant permissions on a least-privilege basis.
Create a token
Create a new token under "API tokens" in the console, selecting the scopes it may access. The token value is usually shown in full only once at creation, so copy and store it somewhere safe immediately.
Keep it safe
- Don't put tokens in front-end code, commit them to a repository, or post them in public channels.
- Store them in environment variables or a secrets manager, and call from the backend.
- Create separate tokens for separate purposes, so they can be revoked individually without side effects.
Revoke and rotate
If you suspect a token is leaked, revoke it in the console immediately — a revoked token stops working at once. Even without a leak, rotate periodically: create a new token, switch over, then revoke the old one, reducing the risk of long-term exposure.