Grant API access

important

Never share tokens or commit them to repositories. Store tokens securely in environment variables or secrets management systems.

Generate API tokens from RBAC roles for programmatic access to the Northflank API. Tokens authenticate users or programs to the API using JSON Web Tokens (JWT).

API tokens inherit permissions from the RBAC role they're generated from. Manage permissions by editing RBAC roles, not individual tokens.

Generate API tokens from RBAC roles in your team or organisation.

1. Navigate to Team Settings → API → Tokens
2. Click Create API Token
3. Configure the token:
   • Name: Descriptive identifier for the token
   • Description: A short description of the token
   • Associated RBAC Role: Select an RBAC role (determines token permissions)
   • Token lifetime: Set expiration time or leave blank for no expiry
4. Click Create API Token
5. Copy the token immediately (shown only once and cannot be retrieved later)
6. Store the token securely (password manager, secrets vault)

Tokens are listed across the team or organisation, but the token secret is only visible at the time of creation.

• Expiry: Tokens can be configured to expire automatically. Set expiry on creation to limit token lifetime.

• Last used: Tokens display their last used time, helping identify inactive or compromised tokens.

• Audit logs (Enterprise): Tokens have their own audit log feed. Audit log items reference specific tokens for tracking API activity.

• View on creation only: Token secrets are only visible once on creation. Save tokens immediately or regenerate if lost.

To update token permissions, edit the RBAC role the token was generated from. Permission changes apply immediately to all tokens using that role.

See the Use role-based access control guide for managing roles and permissions.

Revoke tokens from Team Settings → API → Tokens. Revoked tokens are invalidated immediately and cannot be restored.

Deleting an RBAC role revokes all tokens generated from that role.

The CLI northflank login flow supports generating tokens from organisation roles for cross-team access.