Access tokens

Administrator

Access tokens in the Settings area (Account) — route /settings/access-tokens.

Updated August 12, 2026Reviewed July 30, 2026

Access tokens lives in the Settings area of the dashboard, under Account.

At a glance#


Dashboard route	`/settings/access-tokens`
Area	Settings (`settings`)
Group	Account
Platforms	Available for every app platform.

What it does#

Access tokens are personal API credentials for calling the ScaleBun API as yourself. Each token has a name, read and/or write scopes, an optional expiry, and shows its last four characters, when it was last used, and when it was created.

These are not SDK keys. An SDK key ships in your app and can only write telemetry. An access token acts with your permissions and can read your data.

When to use it#

For anything script-shaped: a scheduled export, a CI check, a custom dashboard, a one-off query against the API.

Workflow#

Grant read only, unless you need write
Most integrations read. A token that cannot write cannot damage anything if it leaks, which is a large reduction in risk for no cost.
Set an expiry
An expiring token has a bounded blast radius. A token that never expires outlives the project it was made for, and usually the person who made it.
Name it after what uses it
"nightly-export-ci" tells you what breaks when you revoke it. "token1" does not, which means nobody ever revokes it.
Check last-used before revoking
A token with no recent use is safe to remove. This column is the whole audit story for tokens.

Permissions and prerequisites#

Anyone can create tokens for themselves. A token carries your own permissions, so it cannot do anything you cannot.

Limits and edge cases#

Scoped, but not app-scoped. Scopes are read and write; a token is not limited to one app.
Tied to your account. When you leave the workspace, tokens you created stop working — which is correct, and a reason not to build shared automation on a personal token.
Revocation is immediate. Anything using it fails on the next call.
Expiry is optional and should not be. Set one.

Troubleshooting#

A script stopped working. Check whether the token expired or was revoked, and whether the person who created it still has access.

403 with a valid token. The token has read and the call needs write, or your own role does not permit the operation. Scopes cannot exceed your permissions.

Where the data comes from#

Served by

Auth
Admin