API tokens

Create API Token

Open Account Settings page from the user menu in the bottom left corner of the sidebar.

1. Click on User menu in the bottom left corner of the sidebar,
2. Select Account Settings from the dropdown

Follow the steps below to create API Token

1. Click on Tokens tab in the Account Settings page
2. Click on Add New API Token
3. Enter the name for the API Token
4. Click on Save button to save the changes
5. Copy the API Token by clicking on Copy button displayed under Actions menu
6. Use the API Token in the services that require it to authenticate as xc-token in the headers.

{
  "headers": {
    "xc-token": "Copied API token here under quotes"
  }
}

API Token created will get added to the list. Copy API token by clicking on Copy button displayed under Actions menu

Delete API Token

Open Account Settings page from the user menu in the bottom left corner of the sidebar.

1. Click on User menu in the bottom left corner of the sidebar,
2. Select Account Settings from the dropdown

1. Click on Tokens tab in the Account Settings page
2. From the Actions menu, click on Delete button associated with the API Token to be deleted

API Token Access with SSO-Enabled Workspaces

If a workspace is configured to enforce Single Sign-On (SSO), API access to that workspace is restricted to tokens that are created after authenticating via SSO.

To access an SSO-enforced workspace via API, users must:

1. Sign in using SSO.
2. Generate a new API token from their authenticated session.

For ease of identification, tokens created after SSO is enabled will have a badge indicating they were generated through SSO authentication.

What Happens When SSO is Disabled?

If SSO is later disabled for a workspace:

• API tokens that were created via SSO authentication will continue to work as long as the user is still active and has the required permissions.
• Tokens created prior to enabling SSO will continue to function & can now access the workspace without SSO authentication.
• No tokens are automatically revoked when SSO is disabled.