Skip to main content
An API token lets a program call MoleSignal without signing in. A service account is an identity for such a program: it cannot sign in, and its tokens act as the account. Open Identity & Access → API tokens or Service accounts.

​
Token types

A token has the form ms_<prefix>_<secret>, and a RUM client token msrum_…. The prefix finds the token, and only a hash of the secret is stored. Send a token as a bearer credential, like a login session:
A token cannot enter the _sys organization.

​
Create an API token

  1. Open API tokens and select Create API token.
  2. Enter a Name, for example collector-production.
  3. Choose the Principal: Current user, or a service account.
  4. Choose the Role. A token of a service account inherits the role of the account. A personal token takes Default intake (write only) or an organization role. The role cannot hold a permission that the creator lacks.
  5. Set Expires in days: 365 by default, at most 1825. Leave it empty for a token that never expires.
  6. Select Create token, then Copy token. The token is shown only this once.
The list shows each token with its prefix, principal, role, type, status, expiry, and last use. Revoke stops a token at once and for good. Listing tokens requires api_tokens.read, and creating or revoking them requires api_tokens.manage.

​
Service accounts

Use a service account for a collector, a CI pipeline, an integration, or an AI agent that runs without a person. Then a member leaving the workspace never breaks the automation.
  1. Open Service accounts and select Create service account.
  2. Enter a Name, for example deployment-automation, a Description, and a Role.
  3. Select Create account and token, and copy the initial API token. It expires in 365 days and is shown only once.
Select an account to manage it: The Principal ID of the account identifies it in audit records and access grants. Reading service accounts requires service_accounts.read, and changing them requires service_accounts.manage.

​
Choose a token

A login session expires after 24 hours by default ([auth].token_ttl_secs), so never give one to a sender that runs continuously.

​
Tokens API

See Issue an API token, List API tokens, and Revoke an API token.
Last modified on October 26, 2026