Overview#

API tokens are long-lived bearer tokens tied to specific users and roles, used for authentication in API requests. They are included in the Authorization: Bearer <token> headers, allowing secure access to resources.

API tokens serve as a secure method for authenticating users and applications. Unlike generic API keys, personal API tokens (PATs) are unique to each user and can be scoped to specific roles.

API tokens are commonly used for:

• Authenticating scripts and integrations.
• Providing access to specific resources based on user roles.
• Enabling secure communication between services.

To generate an API token, navigate to Settings → API tokens → Create. The token will be displayed as a one-time secret; make sure to copy it immediately, as it will not be stored in a readable format.

Follow these best practices for API tokens:

• Use one token per script or integration.
• Revoke tokens immediately when a team member leaves.
• Never commit tokens to version control; use a secret manager instead.

Be aware of these common pitfalls:

• Not setting a maximum age for tokens, leading to potential security risks.
• Failing to rotate tokens regularly, which can expose your system to vulnerabilities.

API tokens are a critical component of secure API authentication. By following best practices and being aware of common pitfalls, you can effectively manage API tokens to protect your applications.