Home › Running the fleet

API tokens

Give a script or an integration access to the fleet console's API with a token, and revoke it the moment it is no longer needed.

What a token is for

Nearly everything is done in the console by hand. An API token is for the rest: a script that reads the rollout list, a monitor that watches for failing tenants, or an integration that files a data export. A token acts as a staff account without a password, so treat it exactly like one.

Creating one

Open API tokens (it is there for admins). Give the token a name you will recognise later, and choose the smallest role that does the job:

• Support — read only. Enough for a dashboard or a monitor.
• Ops — can change tenants (create, update, roll out).
• Admin — can change everything, including staff and tokens.

The value is shown once, when you create it. Copy it then; OPSAVOR never shows it again.

Using one

Send it as a bearer token on every request: Authorization: Bearer fmt_…. Keep it in the script's own secret store — never in a repository, a chat message or a screenshot.

Revoking one

When a script is retired, or a token may have leaked, open API tokens and revoke it. It stops working immediately, and the audit log keeps the record of what it did.