# API Tokens
URL: https://docs.autociso.io/console/settings/api-tokens/
Description: API Tokens provide a secure way for external systems — such as CI/CD pipelines, automated scripts, and AI clients — to interact with the AutoCISO API.

*This is the help text the console shows in the help panel on this page.*

API Tokens provide a secure way for external systems — such as CI/CD pipelines, automated scripts, and AI clients — to interact with the [AutoCISO API](https://docs.autociso.io/api/quickstart/). Unlike user sessions, tokens are designed for [machine-to-machine communication](https://docs.autociso.io/developers/api-tokens/) and follow the **Principle of Least Privilege** through [granular permission scopes](https://docs.autociso.io/developers/access-model/).

Open this page from the user menu (your name at the bottom of the sidebar) → **API Tokens**. [Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) can create and revoke tokens; other roles can only view the list.

### Create a Token
1. Click **Create Token**.
2. Enter a name (e.g. *CI/CD pipeline*), select the scopes, and choose **Expires**: Never, 30 days, 90 days, 1 year, or Custom date.
3. Click **Create Token**, then copy the value in the **Token Created** dialog. It is shown only once.

### Key Features
- **Granular Scopes**: Assign specific permissions (e.g., read-only vs. write) to limit the impact of a compromised token.
- **Expiration Policies**: Set short-lived tokens for transient tasks or long-lived tokens for stable integrations. Some scopes require an expiry date.
- **Instant Revocation**: Click **Revoke** to immediately disable any token if suspicious activity is detected. The list shows each token's scopes, last use, expiry and status (Active, Revoked or Expired).
- **[Employee identity (pii:read)](https://docs.autociso.io/developers/employee-identity/)**: an Owner-only scope that lets an [MCP client](https://docs.autociso.io/developers/mcp/overview/) resolve employee IDs to names and emails. It must expire within 90 days and every use is recorded in the [Audit Trail](https://docs.autociso.io/console/settings/audit-trail/). Tokens about to expire show **Expires in N days** in the list.

### Security Best Practices
- **Never Commit Secrets**: Treat tokens as sensitive credentials. Do not store them in plaintext or commit them to version control.
- **Use Secret Managers**: Store tokens in your CI system's encrypted secrets or a dedicated secrets manager.
- **Rotation**: Regularly rotate tokens used in production environments to minimize long-term risk.
- **One Token Per System**: Create unique tokens for each integration to maintain a clear audit trail and isolated security boundaries.