API Tokens

Manage API access tokens for secure authentication.

Overview

API tokens provide secure, programmatic access to the de.iterate API. Each token can have specific permissions and expiration dates.

Creating Tokens

const result = await client.apiTokens.createToken({
  name: 'CI/CD Integration',
  accessType: 'granular',
  permissions: [
    { resource: 'risks', actions: ['read'] },
    { resource: 'assets', actions: ['read', 'write'] },
  ],
  expiresAt: '2025-12-31',
  description: 'Token for automated deployments',
});

// Save this token securely - it's only shown once!
console.log('Token:', result.token);

Access Types

Type	Description
full	Full access to all resources
granular	Specific permissions per resource

Available Permissions

Action	Description
read	View resources
write	Create and update resources
delete	Remove resources

Listing Tokens

const response = await client.apiTokens.list();

for (const token of response.data) {
  console.log(`${token.name} - Expires: ${token.expiresAt}`);
}

Revoking Tokens

await client.apiTokens.revoke('token-id');

Best Practices

1. Use granular permissions - Only grant necessary access
2. Set expiration dates - Don't create tokens that never expire
3. Rotate regularly - Replace tokens periodically
4. Store securely - Never commit tokens to source control
5. Use environment variables - Load tokens from secure storage

Next Steps

• APITokensResource API - Full API reference
• Authentication - Authentication overview