ImprovedUser InterfaceAPISecurity
App tokens now follow a role permissions: give each integration only the access it needs
You can assign a role to every app token, so AI agents, monitoring tools, and other integrations get exactly the access they need and nothing more. Integrate third-party tools with only permissions they need.
What’s new
1. A role on every token.
When you create a token, you choose a role. Start with Admin, Observer, or User. Choosing Admin shows a reminder that the token gets full account access.2. Expiry is required.
New tokens must have an expiry date. Default is 1 year. Existing tokens with no expiry keep working and still appear in the table with a “never expires” mark.3. Clearer token table.
Table columns for App token table can be now configured for your preferences. A new column shows whether a token was created by a user or by another token. Expired tokens are clearly marked. How this affects you
- Your existing tokens keep working, including ones that never expire.
- New tokens you create need a role and an expiry date.
- Observer is a good fit for read-only tools. User fits operational integrations. Use Admin only when the integration truly needs full access.
- If you manage app tokens through the API, move that code to the v2 application token API by 1 June 2027. Role assignment and the other new fields are on v2 only. Check our migration guide.
- Custom roles on tokens would be soon available.
How to get started
- In the Portal, go to Integrations → Application tokens.
- Create a token, pick the role that matches the integration, and set an expiry date.
- Use that token in your integrations.
