Skip to content
0333 090 4540
Snappyhost

Create and manage Platform API access tokens

Issue time-limited bearer tokens with an appropriate administrator role and optional IP restriction.

Where Settings → Access tokens → Create token

Enhance Platform API access token form with role and IP restriction controls

What this is for

  • Authenticate an approved API integration.
  • Choose Super admin, System administrator, Support or Business scope.
  • Limit the credential by time and source address.

Before you start

  • Identify the integration owner, exact API actions and stable source IP addresses.
  • Choose the least-privileged role and the shortest practical expiry date.

Take care

The token is equivalent to its assigned role. Never place it in screenshots, source control, tickets or browser-side code.

Steps

  1. 1

    Confirm the integration owner, required actions and expected source addresses.

  2. 2

    Select Create token and enter a friendly name that identifies the system and purpose.

  3. 3

    Set an expiry date that matches the shortest practical operating period.

  4. 4

    Choose the least-privileged role: Business, Support, System administrator or Super admin.

  5. 5

    Enable IP restricted when the integration has stable outbound addresses.

  6. 6

    Create the token and copy it immediately into an approved secret store.

  7. 7

    Test, monitor and revoke the token when it is unused, exposed or no longer owned.

Check it worked

  • A safe API test succeeds for an allowed action and fails for an action outside the assigned role.
  • The token is stored only in an approved secret store and can be revoked from Access tokens.

What the controls do

Control What it means
Expiry date Automatically ends the credential's validity.
Super admin Unrestricted platform access. Use only when no narrower role can complete the integration.
System administrator Can manage servers, customers, websites, services and platform settings.
Support Can manage customers and customer websites without unrestricted platform administration.
Business Can manage packages and branding settings.
IP restricted Limits use to the permitted source addresses.
Bearer token A secret credential sent by the API client on every request.