Grant API access

Generate API tokens from RBAC roles in your team or organisation.

1. Open API tokens in your team or organization.
2. Click Create API token
3. Configure the token:
   • Name: Descriptive identifier for the token
   • Description: A short description of the token
   • Associated RBAC role: Select an RBAC role (determines token permissions)
   • Token lifetime: Select a lifetime, or No expiry when available
4. Click Create API token
5. Copy the token immediately (shown only once and cannot be retrieved later)
6. Store the token securely (password manager, secrets vault)

Tokens are listed across the team or organisation, but the token secret is only visible at the time of creation.

• Expiry: Tokens can be configured to expire automatically. Set expiry on creation to limit token lifetime.

• Last used: Tokens display their last used time, helping identify inactive or compromised tokens.

• Audit logs (Enterprise): Tokens have their own audit log feed. Audit log items reference specific tokens for tracking API activity.

• View on creation only: Token secrets are only visible once on creation. Save tokens immediately or regenerate if lost.

To update token permissions, edit the RBAC role the token was generated from. Permission changes apply immediately to all tokens using that role.

See the Use role-based access control guide for managing roles and permissions.

Open API tokens in your team or organization to revoke a token. Revoked tokens are invalidated immediately and cannot be restored.

Deleting an RBAC role revokes all tokens generated from that role.

The CLI northflank login flow supports generating tokens from organisation roles for cross-team access.

For team and project requests with an organization-scoped token, include the target team ID. See Organization API access.