Guide
Keeping your API tokens safe
An API token opens your BUSY data to whatever holds it. A few habits keep each token limited to what one system needs.
Facts reviewed on
Habits that help
- One token per system, named after it, so you can see which system used what on the Activity page and revoke one without touching the others.
- Limit each token to the companies that system needs.
- Give a token for a short project an expiry date.
- Store it in a secret manager when it is shown; it is shown once and cannot be retrieved.
- Send it only in the
Authorizationheader. The API refuses tokens in a request body or query string, which keeps them out of URLs and logs.
When something changes
- Planned change: rotate with an overlap of up to 60 minutes and switch the system over during it.
- Possible leak: revoke the token at once, then create a new one.
- A token flagged “Not used in 90 days” still works; revoke it if nothing needs it.
Local API token
The Local API on your PC has its own token, separate from organization API tokens. Regenerating it stops the old one immediately.