Improvement
This page is also available in Deutsch, Español, Français, Italiano, 日本語, and Português.
Cloud Intelligence™ Expands User API Token Functionality
API access no longer has to run through one shared login. You can scope it to a single user, or to a dedicated identity owned by your organization.
By Eric E.
·Shipped by
What's new
- Up to 10 tokens per user. Create a separate token for each integration, script, or environment tied to your own account. No more sharing one credential across everything you've connected.
- Org-owned Service Account for automated work. A Service Account belongs to the organization, not a person. It keeps working through role changes and offboarding.
- Up to 10 API tokens per Service Account. The same split applies at the org level. Give each pipeline, environment, or workflow its own token.
- Scoped permissions, at both levels. A personal token carries only a slice of your existing role. A Service Account draws from a defined subset of org-level roles.
- Predictable expiration. All tokens default to a one-year lifetime.
- Independent lifecycles. Rotate, disable, or delete one token without touching the others.
Personal tokens vs. Service Accounts
Use a personal token when the integration is tied to you: a script you run, a tool you connect under your own login.
Use a Service Account when the integration needs to outlive any one person: a billing pipeline, a reporting job, anything the team depends on regardless of who built it.
Token lifecycle
Every token, personal or Service Account, moves through four states:
| State | Description |
|---|---|
| Active | In use and valid |
| Disabled | Suspended but recoverable |
| Expired | Past the expiration date (default: 1 year) |
| Deleted | Permanently revoked |
The problem with shared tokens
A single token shared across five integrations is a liability. Rotate it, and everything breaks at once. Split tokens by integration instead, personal or org-owned, and each one rotates on its own.
Most platforms tie automated access to whoever set it up. Service Accounts remove that dependency, so pipelines and reporting jobs keep running regardless of team changes.
Get started
- Manage your personal API tokens: click your email address in the user menu, top-right corner of the header, under your organization name.
- Set up a Service Account: go to Settings, then Users & Access, then Service Accounts.
