{"article":{"id":"b87cfba0d55c2439bd4fddb57c126333","categorySlug":"getting-started","slug":"manage-api-tokens","title":"Automate with the API: personal tokens","excerpt":"Create a personal API token with the right scope and expiry, use it to authenticate your scripts, and revoke it the moment you no longer need it.","body":"Everything you manage in the control panel can also be managed programmatically through the SprintCDN API — useful for deployment pipelines, monitoring dashboards, or any script that should work with your account without a human clicking buttons. To let a script authenticate, you create a personal API token: a secret key that acts on your behalf. Treat every token like a password — anyone who has it can use it.\n\n# Create a token\n\n1. Sign in to the portal and open **Settings** from the sidebar.\n2. Open the **API Access** tab. The **API tokens** card lists any tokens you already have.\n3. Click **Create token**.\n4. **Name** — a label that reminds you what the token is for, for example \"CI deploy\".\n5. **Scope** — choose **Read-only** or **Read \u0026 write** (see below).\n6. **Expiry** — choose **Never**, **30 days**, **90 days**, or **1 year**.\n7. Click **Create token**.\n\n![The API Access tab in Settings, with the API tokens card and the Create token button](/assets/kb/auth/settings-api-tokens.png)\n\n# Copy the secret — it is shown only once\n\nAfter creation, a green banner shows the full token and asks you to copy it now. This is the only time the complete token is displayed — afterwards the list shows only its short prefix. Click **Copy** and store the token somewhere safe, such as a password manager or your CI system's secret storage. If you lose it, you cannot view it again: revoke the old token and create a new one.\n\nEvery token starts with `scdn_`, which makes it recognisable in your configuration. Your script sends it in the `Authorization` header of each API request:\n\n```\nAuthorization: Bearer scdn_your_token_here\n```\n\nThe full API reference — endpoints, parameters and examples — is one click away: use the **View the API reference** link at the top of the API tokens card.\n\n# Choose the right scope and expiry\n\n- **Read-only** — the token can fetch information but cannot change anything. Ideal for monitoring, dashboards and reporting.\n- **Read \u0026 write** — the token can also make changes (it includes read access). Use it for automation that creates or modifies things, such as deployments.\n- Give each integration its own token instead of sharing one. If a single tool is compromised, you revoke one token and the rest keep working.\n- Prefer a scope no wider than the job needs, and set an expiry for anything temporary — an expired token stops working on its own.\n\n# Review and revoke tokens\n\nThe API tokens card shows, for each token, its name, scope, prefix, creation date, when it was last used, and when it expires. The last-used date is a quick way to spot tokens that are no longer needed.\n\nTo revoke a token, click **Revoke** next to it and confirm with **Yes, revoke**. The token stops working immediately. Do this right away if you suspect a token has leaked — for example, if it was committed to a public repository.\n\n\u003e As a safety measure, API tokens cannot be used to create or revoke tokens, or to change security settings on your account. Those actions always require signing in to the portal, so a leaked token cannot take over your account — but protect the sign-in itself with two-factor authentication. See [Sign in and secure your account with 2FA](/kb/create-account-2fa).\n\nIf an API request behaves unexpectedly or you need help with an integration, open a ticket from **Tickets** in the portal.","status":"published","position":5,"createdAt":"2026-07-15T11:11:28Z","updatedAt":"2026-07-15T11:11:28Z"},"related":[{"id":"6f3a33f842c086b21008407151508674","categorySlug":"getting-started","slug":"place-your-first-order","title":"Place your first order","excerpt":"Choose a plan, complete the three-step checkout, confirm your email and pay the invoice — your service activates automatically the moment payment clears.","position":1,"status":"published"},{"id":"b26a2e71300d15dfb15e78ba26217958","categorySlug":"getting-started","slug":"create-account-2fa","title":"Sign in and secure your account with 2FA","excerpt":"Sign in to the SprintCDN portal, reset or change your password, turn on two-factor authentication with recovery codes, and review your active sessions.","position":2,"status":"published"},{"id":"e943b6a8dd2ffe083415b6700803a26b","categorySlug":"getting-started","slug":"control-panel-tour","title":"A tour of the customer portal","excerpt":"Find your way around the SprintCDN control panel — the dashboard, every sidebar area, your account balance, the language selector, and your profile settings.","position":3,"status":"published"},{"id":"998a8c7ac1ba999a15de9ab7869f172a","categorySlug":"getting-started","slug":"support-tickets-chat","title":"Get help: tickets and live chat","excerpt":"Open a support ticket with attachments, follow replies in the portal and by email, or talk to our team over live chat — and see what happens when all agents are busy.","position":4,"status":"published"}]}