API Tokens
Create, rotate, and revoke personal API tokens in Settings for scripts and MCP clients that authenticate as you.
API tokens are personal credentials that authenticate as you. Use them for scripts or MCP clients when you need a token you control from Settings.
Open Settings from the user menu (your name at the bottom-left of the sidebar), then open the API tokens tab.
API tokens appear only when your organization has API access enabled. Organization-owned service tokens live in the Admin Panel API Console, not here.
Create a token
- Go to Settings → API tokens
- Click Create token
- Enter a Name (for example,
Grafana ingestorNightly scripts) - Choose an Expiry (7, 30, 90, or 365 days)
- Select at least one Scope. The picker only shows scopes your plan and org enable.
- Optionally set an IP allowlist (SME and Enterprise). Leave open if you do not need IP pinning.
- Optionally pin the token to your current organization. Unpinned tokens follow your active org when you switch (useful for multi-org MCP or script use).
- Click Create token
- Copy the token immediately. PetroBench shows the secret only once.
Anything using a revoked or rotated token stops working right away.
Manage tokens
| Action | What it does |
|---|---|
| Revoke | Deletes the token immediately. Cannot be undone. |
| Rotate | Revokes the old secret and issues a new one with the same scopes. Update every client. |
| Rename | Changes the display name. |
| Resume | Clears an anomaly pause (Division Admin or higher). |
Filter the list by Status (Active or Expired). Click a token name for scopes, IP allowlist, expiry, and other details.
Personal token vs service token vs Connected apps
| Credential | Where | Best for |
|---|---|---|
| Personal API token | Settings → API tokens | You and your scripts |
| Service token | Admin Panel → API Console → Service Tokens | Integrations and jobs that must outlive a person |
| Connected app (OAuth) | Settings → Connected apps | AI hosts that log you in without pasting a secret |
Rate limits and pauses
If calls return 429, open Admin Panel → API & Integrations → API Console → Usage, then see Rate limits.
Tokens can pause for daily spend ceilings or anomalous use. Resume from the token row when you have permission, or contact a Division Admin.