API tokens

Bearer tokens for the authenticated endpoints, and how to handle them.

1 min read

Some endpoints — version upload in particular — need a bearer token rather than a license key. Manage them under Admin → API tokens.

Creating#

Give the token a name that says where it will be used: github-actions-my-plugin, not token1. When you have five of them and need to revoke one, the name is the only thing that tells you which.

The token is shown once. Copy it into your CI secret store immediately. It cannot be retrieved afterwards — only revoked and replaced.

Using#

curl -X POST https://your-panel.example/api/v1/products/my-plugin/versions/upload 
  -H "Authorization: Bearer YOUR_TOKEN" 
  -F "version=1.4.2" 
  -F "file=@dist/my-plugin-1.4.2.zip"

Revoking#

Revocation is immediate. Revoke as soon as a token is printed into a build log, when someone with access leaves, or when a pipeline is retired.

Hygiene#

One token per consumer, so revoking one never breaks the others.
Never commit a token to a repository.
Review the list periodically and delete what is no longer used — the creation and last-used dates make stale tokens easy to spot.

What tokens do not do#

They do not authenticate the license endpoints. Those take the license key as their credential and are rate limited instead, so your software never has to ship a shared secret.