Skip to content

Create API tokens

An API token lets a script, a CI pipeline, or another system call the Elaichi API without a browser sign-in. Each token belongs to one organization and acts as the person who created it.

Where to find it: Settings → API tokens

Before you start

Permission What it allows
api_token:create Create, list, rename, and revoke your own tokens. The built-in Member role and every role above it include it.
api_token:view See the token names and dates for every member of the organization
api_token:manage Rename and revoke other members’ tokens

Org Owner and Org Admin hold all three. If you hold none of them, the tab tells you that you cannot view API tokens.

How tokens work

Property Behavior
Scope One organization. The token cannot reach any other organization.
Permissions The same as the person who created it. If that person’s role changes, the token follows the new role right away.
Secret Shown once when you create it. Elaichi cannot show it again.
Revoke Takes effect right away. Any client that uses the token fails on its next call.
Managing tokens Only in the app. A token cannot create, list, rename, or revoke tokens.

Create a token

  1. Open Settings → API tokens.
  2. Click Create API token.
  3. Enter a Name that tells you where you will use it, such as CI pipeline or Inventory sync.
  4. Click Create. Elaichi asks you to confirm it’s you.
  5. Copy the token.
  6. Tick the box that says you stored the token securely, then click Done.

You will see the new token in the list with its name, creation date, and last-used time. Your client can now use the copied value.

Warning

Elaichi shows the token only once. Anyone who has it can act in this organization with the creator’s permissions. Keep it in a secret manager. Do not put it in source control or in chat.

Find, rename, or revoke a token

  • Find a token: type in Search by name…. Elaichi searches all tokens you can see, not only the ones on screen.
  • Rename a token: open the row menu, choose Edit, change the name, and save. Renaming does not change how the token works.
  • Revoke a token: open the row menu and choose Revoke. Elaichi asks you to confirm it’s you. Then update every client that still uses the old value.

Revoking cannot be undone. If you still need access, create a new token.

What to know

  • API tokens are different from SCIM tokens, which only provision members, and from the MCP endpoint, which signs in with OAuth as you.
  • Last used is updated when the token authenticates. Never means the token has not been used yet.
  • Create tokens for scripts and integrations from a dedicated account on the least powerful role that does the job. A token made by an Org Owner can do everything an Org Owner can do.
  • To call the API with a token, see Authentication.