Integration tokens

Integration tokens are read-only access keys that let partner applications, such as ContentsVision, read your organization's assignments and media.

What integration tokens are

Some partners and internal tools need to pull your data programmatically: a contents valuation platform reading items and photos, or an internal reporting pipeline. An integration token is a bearer token the partner app presents with each request. Tokens are read-only: a partner app holding one can read assignments and media but can never create, change, or delete them. The one thing a token can record is which ContentsVision claim an assignment was imported into, so the console can link to it (see Assignments). It sends only the claim's id; the console builds the link to ContentsVision itself.

Managing tokens requires the integration.manage permission, which only Adjust Square staff hold. Ask Adjust Square to set one up. Open Settings and click the Integrations card. People without that permission do not see the Integrations link at all.

Creating a token

1. Click to create a new token.
2. Enter a Name that identifies the partner app. The default suggestion is "ContentsVision".
3. Save and copy the token immediately.

Tokens are shown once

Like webhook signing secrets, the full token is displayed only at creation. After the dialog closes, the list shows just the token prefix. If you lose the token before handing it to the partner, revoke it and create a new one.

Scope

Every token grants the media.read scope across every assignment in this org. The creation dialog states this plainly: "The token grants read-only access (media.read) to every assignment in this org." There are no narrower scopes today, so issue tokens only to partners you trust with org-wide read access.

Organizations set up from ContentsEstimation

When your team is in ContentsEstimation, Adjust Square sets up your ContentsCapture organization for you. ContentsEstimation is where you add and remove people, and ContentsCapture follows it. When a team is created in ContentsEstimation, it is marked as a standard or an enterprise customer, and that decides where it lands:

• Standard customers: the team becomes its own organization, with a Default business unit and a Default Team, ready for assignments. If you rename your team in ContentsEstimation, the organization name follows.
• Enterprise customers: every team from the same company lands in that company's one organization, as its own team. New teams go into the first business unit, and an org admin can reorganize them from there. Renaming the team or the company in ContentsEstimation renames them here too.
• Moving a team between standard and enterprise, or to a different enterprise company, is not done automatically, because the team's claims would have to move with it. Adjust Square staff handle it.
• People with a phone number get a ContentsCapture login on that number and a member seat: in your organization for a standard customer, or on their own team for an enterprise customer. They install the app, enter their phone number, type the text code, and they are in. People without a phone number are not added.
• Someone who already has a login keeps it as it is. If their phone number already signs in to ContentsCapture, they get the member seat on that same login, and their name and email in ContentsCapture stay as they were.
• Changing someone's phone number in ContentsEstimation moves their seat to a login on the new number. The old number loses that seat, but any other access it had stays.
• Removing someone in ContentsEstimation takes away their access to your organization (for an enterprise customer, to that one team). If they belong nowhere else, their login is switched off too.
• ContentsVision is connected for you for standard customers. An enterprise team is not given one automatically yet, because a token reads the whole organization, which would include every other team in the company. Its token appears in the table below as ContentsVision (automatic). Adjust Square replaces that token when it reconnects, but it never touches a token you created yourself.

A role you change by hand in ContentsCapture, such as making someone a Team admin, stays as you set it.

The tokens table

Column	Meaning
Name	The label you gave the token.
Token prefix	The first few characters, enough to identify which token is which.
Scopes	What the token can do (media.read).
Status	Active, expired, or revoked.
Last used	When the partner app last presented this token. A token that has not been used in months is a revocation candidate.
Created	When the token was issued.

Revoking a token

Click Revoke on a token's row and confirm. The confirmation warns: "The partner app loses access immediately."

Revocation is immediate and cannot be undone. The partner's next request fails, and there is no grace period. If the partner still needs access, create a fresh token and deliver it through a secure channel.

Security guidance

• Store tokens in a secrets manager, not in email, spreadsheets, or chat messages.
• Rotate regularly. Create a new token, give it to the partner, confirm their switch-over, then revoke the old one.
• Revoke unused tokens. Check the Last used column quarterly; anything idle for months should go.
• One token per partner. Never share a token between two apps. Separate tokens let you revoke one partner without disturbing another, and the audit trail shows which token made which request.
• Treat a leaked token like a leaked password. If a token may have been exposed, revoke it immediately and issue a replacement.