API Tokens

This is the help text the console shows in the help panel on this page.

API Tokens provide a secure way for external systems — such as CI/CD pipelines, automated scripts, and AI clients — to interact with the AutoCISO API. Unlike user sessions, tokens are designed for machine-to-machine communication and follow the Principle of Least Privilege through granular permission scopes.

Open this page from the user menu (your name at the bottom of the sidebar) → API Tokens. Owners and Managers can create and revoke tokens; other roles can only view the list.

Create a Token

1. Click Create Token.
2. Enter a name (e.g. CI/CD pipeline), select the scopes, and choose Expires: Never, 30 days, 90 days, 1 year, or Custom date.
3. Click Create Token, then copy the value in the Token Created dialog. It is shown only once.

Key Features

• Granular Scopes: Assign specific permissions (e.g., read-only vs. write) to limit the impact of a compromised token.
• Expiration Policies: Set short-lived tokens for transient tasks or long-lived tokens for stable integrations. Some scopes require an expiry date.
• Instant Revocation: Click Revoke to immediately disable any token if suspicious activity is detected. The list shows each token’s scopes, last use, expiry and status (Active, Revoked or Expired).
• Employee identity (pii:read): an Owner-only scope that lets an MCP client resolve employee IDs to names and emails. It must expire within 90 days and every use is recorded in the Audit Trail. Tokens about to expire show Expires in N days in the list.

Security Best Practices

• Never Commit Secrets: Treat tokens as sensitive credentials. Do not store them in plaintext or commit them to version control.
• Use Secret Managers: Store tokens in your CI system’s encrypted secrets or a dedicated secrets manager.
• Rotation: Regularly rotate tokens used in production environments to minimize long-term risk.
• One Token Per System: Create unique tokens for each integration to maintain a clear audit trail and isolated security boundaries.