How do I rotate or revoke a credential?
Download MarkdownIt depends which kind you have, and only the account owner can do either one.
It depends which kind you have, and only the account owner can do either one.
The account API token has no revoke, only Regenerate, on its row in Settings -> API. The old value stops working immediately and every integration still using it breaks until you paste in the new one, so line up those updates before you click.
A scoped credential has a Revoke button on its row. It takes effect immediately, and the row stays in the table marked "Revoked" so you keep the record of what existed.
If you simply lost the value, there is no reveal to fall back on. Revoke it and mint a replacement.
Before you conclude a credential has died, check what the integration is actually sending. A scoped credential begins cmk_ and is 68 characters long; example text copied out of a snippet, or a slot still wrapped in angle brackets, is not a credential at all and fails the same way a revoked one does.
Related Articles
- What can the CloseMagnet API do?It reads almost everything in your account, and what it writes is deliberately narrow. Its endpoints span 17 domains and the large majority are read-only. The ones that write do one of these things:
- How do I create an API credential?Only the account owner can mint one, and it happens at Settings -> API.
- What is the difference between my account API token and a scoped credential?Your account API token was minted automatically when the account was created. It sits pinned as the first row in Settings -> API with the type "Automatic", carries a fixed set of scopes, can be revealed again at any time, and can
- Which scopes should I pick?Select the fewest permissions your integration actually needs. Settings -> API shows the scopes an owner can choose. A registered system permission is not necessarily a selectable customer credential option, so follow the current