Appearance
Integration tokens
Integration tokens are read-only access keys that let partner applications, such as ContentsVision, read your organization's assignments and media.
What integration tokens are
Some partners and internal tools need to pull your data programmatically: a contents valuation platform reading items and photos, or an internal reporting pipeline. An integration token is a bearer token the partner app presents with each request. Tokens are read-only: a partner app holding one can read assignments and media but can never create, change, or delete anything.
Managing tokens requires the integration.manage permission, held by org admins only. Find the page at System → Integrations.
Creating a token
- Click to create a new token.
- Enter a Name that identifies the partner app. The default suggestion is "ContentsVision".
- Save and copy the token immediately.
Tokens are shown once
Like webhook signing secrets, the full token is displayed only at creation. After the dialog closes, the list shows just the token prefix. If you lose the token before handing it to the partner, revoke it and create a new one.
Scope
Every token grants the media.read scope across every assignment in this org. The creation dialog states this plainly: "The token grants read-only access (media.read) to every assignment in this org." There are no narrower scopes today, so issue tokens only to partners you trust with org-wide read access.
The tokens table
| Column | Meaning |
|---|---|
| Name | The label you gave the token. |
| Token prefix | The first few characters, enough to identify which token is which. |
| Scopes | What the token can do (media.read). |
| Status | Active, expired, or revoked. |
| Last used | When the partner app last presented this token. A token that has not been used in months is a revocation candidate. |
| Created | When the token was issued. |
Revoking a token
Click Revoke on a token's row and confirm. The confirmation warns: "The partner app loses access immediately."
Revocation is immediate and cannot be undone. The partner's next request fails, and there is no grace period. If the partner still needs access, create a fresh token and deliver it through a secure channel.
Security guidance
- Store tokens in a secrets manager, not in email, spreadsheets, or chat messages.
- Rotate regularly. Create a new token, give it to the partner, confirm their switch-over, then revoke the old one.
- Revoke unused tokens. Check the Last used column quarterly; anything idle for months should go.
- One token per partner. Never share a token between two apps. Separate tokens let you revoke one partner without disturbing another, and the audit trail shows which token made which request.
- Treat a leaked token like a leaked password. If a token may have been exposed, revoke it immediately and issue a replacement.