> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

> API Tokens provide a secure way of accessing FlexDeploy REST APIs by protecting user credentials. API Tokens are randomly generated secure strings tha

API Tokens provide a secure way of accessing FlexDeploy REST APIs by protecting user credentials.

API Tokens are randomly generated secure strings that can be used as replacements for a user’s password when accessing FlexDeploy REST API. This is the preferred method of authentication as personal passwords are not sent over the network. As of 11.1, an option for SSO-user API Token group + permission caching is available on the settings page. By default it is set to 0, which means that no groups or permissions will be available for SSO-user API Tokens.

![image-20251204-161238.png](https://mintcdn.com/flexagon-llc-ce77a95c/s5KJA2KdwTZ5hdNK/images/fd111/12590915830.png?fit=max\&auto=format\&n=s5KJA2KdwTZ5hdNK\&q=85\&s=b1eae2135728202c62441c1cebff4fd0)

## Generating a New Token

![(blue star)](https://flexagon.atlassian.net/wiki/s/-845207469/6452/623c691c1356a9708795fbf2d3eb7953dc11488c/_/images/icons/emoticons/72/31-20e3.png) To generate a new token, click on your profile picture in the upper right-hand corner of the header and select ***Profile*** and then click on **Tokens** on the left side. On the API Tokens page, click on **Add Token** button at the bottom of the list.

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590915824.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=96655d734a2fe10caf1effd0de98eddf)

![(blue star)](https://flexagon.atlassian.net/wiki/s/-845207469/6452/623c691c1356a9708795fbf2d3eb7953dc11488c/_/images/icons/emoticons/72/32-20e3.png) This will open a popup where you can provide a **name** for the token and an **expiration date.**

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/s0aZcWvz1eo3cr__/images/cm112/12725923343.png?fit=max\&auto=format\&n=s0aZcWvz1eo3cr__\&q=85\&s=5403f1466f0d2e6a0f5055cfd6e6da08)

![(blue star)](https://flexagon.atlassian.net/wiki/s/-845207469/6452/623c691c1356a9708795fbf2d3eb7953dc11488c/_/images/icons/emoticons/72/33-20e3.png) Save and **Copy** the token.

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/s0aZcWvz1eo3cr__/images/cm112/12725923346.png?fit=max\&auto=format\&n=s0aZcWvz1eo3cr__\&q=85\&s=bd909979da7f038ee0da082fc05d49ea)

> [!TIP]
>
> Once this popup is closed you will NEVER be able to view the token value again, so keep it in a safe place.

## Using a Token

Once generated a token can be used as a direct replacement for the user’s password.

### CURL Example

```
curl -u "joel:wA5h-or8IHwCx5__IGdMgdEMf1NtGQdV" http://flexdeployhost:8000/flexdeploy/rest/v2/project
```

### Postman Example

![Image](https://mintcdn.com/flexagon-llc-ce77a95c/s0aZcWvz1eo3cr__/images/cm112/12725923331.png?fit=max\&auto=format\&n=s0aZcWvz1eo3cr__\&q=85\&s=7dce02b52ea76f31433cd55867d8b775)

## Token Metadata

The token itself has certain metadata associated to it to help provide more insightful tracing and debugging of a token.

<table><colgroup><col /><col /></colgroup><tbody><tr><th>**Field**</th><th>**Description**</th></tr><tr><td>Token Name</td><td>This is for display only and to help you recognize tokens after they have been created. The name should closely resemble how you intend to use the token.</td></tr><tr><td>Expiration Date</td><td>A token can no longer be used once the Expiration Date has been reached. It is possible to define a token with no expiration, though it is not recommended.</td></tr><tr><td>Last Accessed On</td><td>This provides a timestamp of when the token was last used. You can use this for both monitoring suspicious activity and determining if a token is still in use.</td></tr><tr><td>Last Accessed Origin</td><td>This shows the IP address from where the token was last used. Similar to Last Accessed On, this can be used to monitor suspicious activity.</td></tr></tbody></table>
Field	Description
Token Name	This is for display only and to help you recognize tokens after they have been created. The name should closely resemble how you intend to use the token.
Expiration Date	A token can no longer be used once the Expiration Date has been reached. It is possible to define a token with no expiration, though it is not recommended.
Last Accessed On	This provides a timestamp of when the token was last used. You can use this for both monitoring suspicious activity and determining if a token is still in use.
Last Accessed Origin	This shows the IP address from where the token was last used. Similar to Last Accessed On, this can be used to monitor suspicious activity.