API tokens

Hi Nina! This page is mostly for developers, but it's easy to understand — here's what it does.

What this is

An API token is a long secret password that lets another computer program talk to the CMS on its own, without a person signing in. Developers use tokens to connect outside apps, scripts, and integrations to your system — for example a backup script, or a website that needs to read your product list automatically.

Think of a token as a key you hand to a trusted program. The API tokens page is where you create those keys, see the ones that exist, and switch off any you no longer trust.

Keep tokens secret

A token is like a password. Anyone who has it can act against your CMS. Never post a token in email, chat, or a shared document, and only give one to a developer you trust. If a token might have leaked, revoke it straight away (see below).

How to open it

1. Sign in to the CMS admin.
2. In the menu, click API tokens.
3. You'll see the Create token box at the top and the list of existing tokens below it. If there are none yet, the list says "No API tokens yet."

What you can do here

Create a token (usually with a developer)

1. In the Token name box, type a clear name so you'll recognise it later, for example Backup script.
2. In the Scopes box, leave the default * unless a developer has told you exactly what to type. Scopes limit what the token is allowed to do; * means "everything". If you were given a specific list, type the values separated by commas.
3. Click Create token.
4. A green box appears showing the secret token. Copy it now — this is the only time it's ever shown. Once you leave or click Dismiss, it can't be shown again.
5. Give the copied secret to the developer through a safe channel, then click Dismiss.

You only see the secret once

The CMS shows the full secret exactly once, right after you create it. If you lose it, you can't get it back — you'll have to revoke that token and create a new one.

Revoke a token (switch it off)

Revoking turns a token off so it stops working, while keeping a record that it existed.

1. Find the token in the list.
2. Click Revoke on its row.
3. A pop-up warns that any program using it will lose access. Click OK to confirm.
4. The token's status changes to revoked and it stops working immediately.

Revoke a token whenever a program no longer needs it, or if you suspect the secret has leaked.

Delete a token row

1. Find the token in the list.
2. Click Delete on its row.
3. A pop-up asks you to confirm removing the row permanently. Click OK.

Deleting just removes the row from this list. To actually stop a token working, use Revoke.

Every field explained

What you see	What it means
Token name	The name you gave the token, so you can recognise what it's for.
Scopes	What the token is allowed to do. * means everything; a comma-separated list limits it.
Prefix	The first few visible characters of the token (shown as abc...). This is just a label to tell tokens apart — it is not the full secret.
Created	The date the token was made.
Last used	The last time a program used this token, or never if it hasn't been used yet.
Status	active (green) means it works; revoked (grey) means it's switched off.
Revoke	Switches the token off. Shown only while it's still active.
Delete	Removes the row from the list.

Common mistakes

Watch out for these

• Not copying the secret in time. The full token is shown only once, right after you create it. Copy it before you click Dismiss — there's no way to see it again.
• Sharing a token carelessly. A token is a password. Don't send it over email or chat where others can see it, and only hand it to someone you trust.
• Deleting when you meant to revoke. Delete only removes the row from the list. To actually stop a token from working, click Revoke.
• Changing scopes on a guess. If you're not sure what to put in Scopes, leave the default * or ask a developer. Typing the wrong scope can stop the connected program from working.

Still stuck?

We're happy to help. Email developers@kavelsoftware.se and we'll walk you through it.