API tokens in Workspaces
API tokens let scripts and tools such as Terraform use the UpCloud API. In Workspaces, you create API tokens in a workspace, and they work in that workspace only.
To create a token, open the workspace's settings, select the API tokens tab and click Add new API token. For the token settings, see How to create and use UpCloud API tokens.
What a token can access
What a token can access depends on your access level in the workspace when you create it:
| Created with | The token can access | If the creator's access level changes |
|---|---|---|
| Owner or Full access | Everything in the workspace | The token keeps working until someone deletes it |
| Limited access | Only what the creator has been granted through custom access | The token stops working |
Tokens created with Owner or Full access belong to the workspace, not to the person who created them. They keep working when that person's access is lowered, and after the person has been removed from the workspace. Owners and Full access members see these tokens on the API tokens tab, and can delete them. Limited access members see only their own tokens.
The API tokens tab doesn't show who created a token, so give each token a name that says who or what uses it, such as alex-terraform or ci-deploy.
Give a script limited access
A token created with Owner or Full access can do everything in the workspace. To give a script or integration access to only part of a workspace, create its token as a separate Limited access member:
- Add a member for the script with Limited access, using an email address that you control, such as a team mailbox.
- Accept the invitation as that member, signing up with that email address.
- Set the member's custom access to the resources that the script needs.
- Log in as the member, and create the token on the API tokens tab of the workspace's settings.
When you change the member's custom access later, the change applies to the existing token, so you don't need a new one.
When someone leaves
When you remove someone who had Owner or Full access, or lower their access, delete the API tokens they created:
- Open the workspace's settings and select the API tokens tab.
- Delete the tokens that the person created. The tab doesn't show who created each token, which is why it helps to name tokens after the person or integration that uses them.