API Token Security Best Practices

TL;DR

• If separate processes require different scopes, use separate tokens rather than one wide-scope token
• A leaked token with reduced access is less risky than a single token with full API access
• Consider setting tokens to expire when the task is complete, e.g. a few hours for a one-time import

Token Scoping and Expiration

If separate processes require different scopes (for example, read and write), consider using separate tokens, one for each scope, rather than a single token with a wide scope like full API access. This way, if one token leaks, it grants only reduced access instead of full access. It’s also worth setting a token to expire once your task is complete. For example, if you need to perform a one-time import, set the token to expire after a few hours.