Skip to content
Sidedoor

API tokens

An API token is a stable, revocable credential you create once and store in your backend to call the Sidedoor API for long-lived, server-to-server integrations - without logging in interactively. It presents the same identity to the API as a logged-in operator, so your existing Authorization: Bearer <token> handling stays unchanged.

Creating a token

Section titled “Creating a token”

Tokens are self-service from your operator account: open Access in the sidebar, then the API tab, and click Create Token. You choose:

  • Name - a label to recognise it later (it is not part of the secret).
  • Role - a defined role from your account’s Roles, which sets exactly what the token can do. It can never do more than you can.
  • IP allow-list (optional) - restrict the token to specific IP addresses.
  • Expiry (optional) - 30 days, 3 months, 6 months, 12 months, never, or a custom date.

The secret is a prefixed string, shown once at creation:

sk_<secret>

Only a one-way hash is stored server-side; the raw value cannot be recovered. Copy it into your secrets store when it is shown - you will not see it again.

Using a token

Section titled “Using a token”

Send it as a bearer token on any API request:

Terminal window
curl https://<your-host>/api/venues \
  -H "Authorization: Bearer sk_your_token_here"

The request is authorised exactly as an operator of your account would be, bound to your operator account and your venues. It cannot act outside your account.

Scoping

Section titled “Scoping”

Tokens are operator-scoped: bound to your operator account and authorised by the role you assign. Restrictions are enforced on every call - an expired token, a revoked token, or a call from an IP outside the allow-list is rejected.

Rotation & revocation

Section titled “Rotation & revocation”
  • Roll (rotate) - rolling a token issues a new secret while keeping its role, IP allow-list and expiry, so you can rotate on a schedule (or after a suspected leak) without re-provisioning your integration. The old secret stops working immediately; the new one is shown once.
  • Edit - click a token to change its role, IP allow-list or expiry in place; the secret does not change.
  • Expiry - tokens may carry an optional expiry, after which they are rejected.
  • Revocation - a token can be revoked immediately, invalidating just that token without affecting your others. There is no grace period.

Manage all of this - create, roll, edit, revoke - from Access → API in your operator account.