Create and manage API tokens
Personal access tokens let a script or an MCP client act as you through the API. Their format, lifetime, scopes and rules, and how to revoke one.
On this page
A personal access token lets a script, a CI job or an MCP client call iyedy's API as you. It reaches one organisation, carries only the scopes you chose, and stops working when it expires or when it is revoked.
Create a token
Coming soonCreate and revoke your tokens from your iyedy account.
There is no screen in iyedy to create a token yet. If you need API access before it arrives, write to support@iyedy.com and say what the token is for. This page describes the rules a token follows, which do not depend on where it is made.
What a token is
| Form | crt_pat_ followed by 16 letters and digits, an underscore, then 43 characters |
| Acts as | you, in one organisation, optionally in one workspace only |
| Scopes | any of cartouche.read, cartouche.graph, cartouche.write, cartouche.propose: see Scopes |
| Lifetime | 1 to 365 days, 90 by default |
| How many | 50 active tokens per person and organisation |
To create a token, your account needs a verified e-mail address and a recent sign-in: within the last 10 minutes. When your organisation enforces single sign-on, that rule holds for tokens too. On Enterprise, personal access tokens are off unless the organisation turns them on; the policy is checked when a token is made and again on every use.
Keep the secret
iyedy keeps only a fingerprint of the token, never the token itself. Copy it when it is shown: nobody can show it to you again. If you lose it, revoke it and make a new one.
- Store it in a secret store: your CI's secrets, a password manager, your MCP client's credentials. Never in a repository, a ticket or a chat.
- One token per job, with the fewest scopes, so you can revoke one without stopping the others.
- iyedy removes tokens from its logs and never puts them in the audit log.
Use a token
Send it in the Authorization header of each request:
GET /v1/token HTTP/1.1
Host: app.iyedy.com
Authorization: Bearer crt_pat_…
GET /v1/token works with any scope and answers what the token is: its name, owner, organisation, workspaces with your role in each, scopes and expiry. On a request with a token, a session cookie is ignored.
What a token can do is the meeting of its scopes and your role, checked on every request. If your role in a workspace drops, the token loses that access at once. If you leave the organisation, the token reaches nothing.
Revoke a token
A token stops working on the next request after it is revoked. It can be revoked:
- by you, its owner;
- by an owner or security administrator of the organisation, one token or all of the organisation's tokens at once.
Until the token screen arrives, write to support@iyedy.com to revoke a token. In an organisation, creating and revoking tokens is recorded in the audit log, and so is the first refused use of an expired, revoked or blocked token.
If it doesn't work
401 with reason invalid_token
The token is mistyped or incomplete. Check that the header reads Authorization: Bearer followed by the whole token, with no line break.
401 with reason token_expired or token_revoked
The token reached the end of its lifetime, or someone revoked it. Make a new one.
401 with reason pats_disabled
Your organisation does not allow personal access tokens. On Enterprise they are off by default; ask an owner. For CI, a service account may be the right tool.
403 with reason insufficient_scope
The token lacks the scope the route needs; the answer names it in required. Make a token with that scope.
All the codes: Rate limits and errors.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.