Managing API Tokens

An API token (the API resource accesstoken, shown as API tokens in the UI) is a bearer credential that authenticates programmatic calls into Celigo -- the native integrator.io REST API, any custom APIs you have built in the account, and your MCP servers. It is the machine-to-machine equivalent of a user login: where a person signs in through the UI, a script presents an API token. Managing tokens is an owner/administrator capability.

Two things to keep straight up front:

• Direction is inbound. An API token governs traffic coming into Celigo -- the opposite of connections and iClients, which authenticate Celigo's outbound calls out to external systems. This is the most common conceptual mix-up; see API Token vs Connection OAuth Token.
• The token value is a real secret. It is masked as ****** in normal responses and shown in full only once, at generation. Treat it like a password: never paste a real token into chat and never read one back.

Concerns when managing API tokens:

• Token kind -- a personal access token (PAT) tied to your own user vs an account API token owned by the account. See Personal Access Tokens (PATs) vs Account API Tokens.
• Access scope -- fullAccess (whole account) vs least-privilege resource scoping (_connectionIds, _exportIds, _importIds, _apiIds, _mcpServerIds). The two are mutually exclusive.
• Lifecycle -- generate, revoke, delete (a token must be revoked before it can be deleted).
• Expiry -- optional autoPurgeAt self-destruct for short-lived tokens.
• Secret handling -- capture the value once at generation; rotate rather than reuse a leaked token.
• Auto-managed variants -- connector integration tokens and APIM tokens you do not hand-craft.