Managing API Tokens An API token (the API resource accesstoken , shown as API tokens in the UI) is a bearer credential that authenticates programmatic calls into Celigo -- the native integrator.io REST API, any custom APIs you have built in the account, and your MCP servers. It is the machine-to-machine equivalent of a user login: where a person signs in through the UI, a script presents an API token. Managing tokens is an owner/administrator capability. Two things to keep straight up front: Direction is inbound. An API token governs traffic coming into Celigo -- the opposite of connections and iClients, which authenticate Celigo's outbound calls out to external systems. This is the most common conceptual mix-up; see API Token vs Connection OAuth Token . The token value is a real secret. It is masked as
in normal responses and shown in full only once, at generation. Treat it like a password: never paste a real token into chat and never read one back. Concerns when managing API tokens: Token kind -- a personal access token (PAT) tied to your own user vs an account API token owned by the account. See Personal Access Tokens (PATs) vs Account API Tokens . Access scope -- fullAccess (whole account) vs least-privilege resource scoping ( _connectionIds , _exportIds , _importIds , _apiIds , _mcpServerIds ). The two are mutually exclusive. Lifecycle -- generate, revoke, delete (a token must be revoked before it can be deleted). Expiry -- optional autoPurgeAt self-destruct for short-lived tokens. Secret handling -- capture the value once at generation; rotate rather than reuse a leaked token. Auto-managed variants -- connector integration tokens and APIM tokens you do not hand-craft. Show more Installs 1.1K Repository celigo/ai GitHub Stars 4 First Seen Jul 25, 2026 Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass