What is the difference between my account API token and a scoped credential?
Download MarkdownYour account API token was minted automatically when the account was created. It sits pinned as the first row in Settings -> API with the type "Automatic", carries a fixed set of scopes, can be revealed again at any time, and can
Your account API token was minted automatically when the account was created. It sits pinned as the first row in Settings -> API with the type "Automatic", carries a fixed set of scopes, can be revealed again at any time, and can be rotated but never revoked. It is a 64-character string with no prefix.
A scoped credential is one you name and mint yourself, with only the scopes you grant and an optional expiration. It is shown once, and it can be revoked on its own. It begins cmk_ and is 68 characters long.
Either one travels the same way: the header name is Authorization, and the value is the word Bearer, then one space, then the token itself.
Here is the part that catches people out. The account token carries the intake and webhook write scopes, not the account-wide read scopes, so a GET to /api/v2 with it answers 401. Mint a scoped credential for reads.
Related Articles
- What can the CloseMagnet API do?It reads almost everything in your account, and what it writes is deliberately narrow. Its endpoints span 17 domains and the large majority are read-only. The ones that write do one of these things:
- How do I create an API credential?Only the account owner can mint one, and it happens at Settings -> API.
- How do I rotate or revoke a credential?It depends which kind you have, and only the account owner can do either one.
- Which scopes should I pick?Select the fewest permissions your integration actually needs. Settings -> API shows the scopes an owner can choose. A registered system permission is not necessarily a selectable customer credential option, so follow the current