Create and revoke API tokens

From Pro up

An admin creates API tokens under Settings → Developer → API tokens. A token belongs to the organization, not to the admin who created it, so it keeps working when that person leaves. Revoking a token ends it at once and for good.

Create a token

1. Go to Settings → Developer → API tokens.
2. Give the token a name that says where it runs, such as Grafana or a nightly script. Only admins see the name.
3. Choose when it expires: after 30 days, 90 days or 365 days, or never. The default is 365 days.
4. From Teams up, choose its access: Read only or Read and write. Read only is the default. Write access lets the token start exports and nothing else.
5. Press Create token.

The next page shows the token once. Copy it then: we keep only a hash of it, so nobody can show it to you again. The page also shows a curl example with the new token in it, and Prometheus and MCP examples where the plan includes them. In the list of tokens, each one shows as mm_ and its first few characters, so you can tell them apart.

What a token reaches

A token reads the domains, reports, sources, DNS checks and alerts of its organization through the API. Where the plan includes them, it also reads /metrics and the MCP server. Each token has its own count of requests per hour.

A token keeps the access it was created with. To let a script write, create a new token with write access, put it in the script and revoke the old one.

How many tokens

The plan sets how many active tokens the organization can have, as the plan table shows. The count covers tokens that are neither revoked nor expired. When all of them are in use, the page says so. Revoke a token you no longer use, then create the new one.

When a token expires

14 days before a token expires, the list marks it Expires soon. Create a new token, put it in the script and revoke the old one before the day comes. A request with an expired token gets token_expired. The token stays on the list, marked as expired, until an admin revokes it.

When the plan changes

• A plan with fewer tokens. The oldest tokens keep working, up to the new plan's count. The newer ones are marked Paused by the plan, and a request with one gets plan. A paused token works again when an older one is revoked or expires, or when the plan includes more tokens.
• A plan without the API. Every token is kept, and every request with one gets plan until the organization is back on a plan from Pro up. The tokens then work as before.
• A plan without write access. A token made to read and write keeps reading. A request that writes gets plan.

Revoke a token

Press Revoke on the token's row. From that moment every request with it gets unauthorized, so every script that uses it stops. You cannot undo it. Revoking works on every plan, so an admin can tidy up after a move to a smaller plan.

If a token may have leaked, revoke it and create a new one. Send a token only in the Authorization header: the API refuses one in the address.

Published 27 October 2026 · Checked 27 October 2026