Skip to main content
Causeloop provides two types of machine credentials for API access:
  • Personal API tokens (PATs) — scoped tokens tied to your user account. Use them for personal scripts, local development, and tooling that acts on your behalf.
  • Service accounts — workspace-level principals with their own identity and tokens. Use them for CI/CD pipelines, backend integrations, and any process that should not be tied to a specific person.
Open the API Keys screen from the sidebar: Settings → API Keys.
To learn how to authenticate API requests with a token, see API Reference → Authentication.

​
Personal API tokens

​
Create a token

1

Click + New API token

The token creation dialog opens.
2

Give the token a name

Choose a descriptive name (e.g. local-dev, grafana-integration). Names must be unique within your account.
3

Select scopes

Check the scopes the token should have. Only grant scopes the integration actually needs.
4

Set an expiry (optional)

Tokens are long-lived by default. Set an expiry date if the token is for a short-lived use.
5

Copy the secret

The token secret is shown once immediately after creation. Copy it now and store it in a secrets manager. Causeloop only stores a hash of the secret and cannot display it again.

​
Rotate a token

Click Rotate on any token row. Causeloop issues a new secret and immediately invalidates the old one. Copy the new secret from the dialog before closing it.
Rotating a token invalidates the old secret immediately. Update all integrations using the old token before rotating.

​
Revoke a token

Click Revoke on a token row. The token is invalidated immediately and all subsequent requests using it return 401 unauthorized. Revoked tokens cannot be re-activated; create a new token if you need access again.

​
Available scopes

Use the minimum scopes necessary for the integration. You can retrieve the current scope catalogue from GET /v1/api-tokens/scopes.

​
Service accounts

Service accounts are workspace-level machine principals. Unlike personal tokens, they are not tied to any user and remain active even if the user who created them leaves the workspace. Creating and managing service accounts requires the workspace:admin scope (Tenant Admin role).

​
Create a service account

1

Click + New service account

The service account creation dialog opens.
2

Enter a name and description

Names must be unique within the workspace (case-insensitive).
3

Select scopes

Choose the scopes this service account’s tokens will be allowed to use.
4

Save

The service account is created. It starts with no tokens.

​
Issue a token for a service account

Once the service account is created, click Issue token on its row.
  • Give the token a name.
  • The token secret is shown once. Copy it immediately.
  • Tokens are associated with the service account’s scopes at issuance time. Changing the service account’s scopes does not update already-issued tokens.

​
Revoke a service account token

Click Revoke on an individual token entry under the service account. The token is invalidated immediately.

​
Delete a service account

Click Delete on a service account row. All tokens associated with the account are revoked immediately.

​
API endpoints

For the full REST specification and how to use tokens in requests, see API Reference → Authentication.