Syncplify.me Server v8

Appearance

Automation tokens ​

Automation tokens are unattended credentials for the Admin REST API, for scripts, orchestration tools and AI agents that manage your virtual site without a person signing in. A token is bound to your own Admin account: it can do at most what you can do, it is read only unless you say otherwise, and it stops working when your account is disabled. The full model is described in Automation tokens in the Automation and AI agents chapter.

Automation tokens are a license gated feature (Professional and Ultimate). They are also off until the SuperAdmin enables them under Global Configuration, Automation. When they are off, or when the SuperAdmin does not allow Admins to create tokens, the page says so in a notice: your existing tokens stay listed and can still be revoked, but the New token action is hidden.

Token list ​

The list shows the tokens bound to your account, with the name and description, a status tag (active, expired, disabled or revoked), the scopes (read only, or the objects the token may edit), the expiry date (with the days left when fewer than fourteen remain), when and from which address the token was last used, and how many addresses its allow list holds. Revoked tokens stay in the list until the retention period set by the SuperAdmin ends.

Create a token ​

Click New token. The dialog asks for:

  • Name (required) and an optional description. Name the token after the integration that will use it.
  • Expiry (required). The default is the policy default; the date cannot be later than the policy maximum, shown in the hint. There is no token without an expiry.
  • Read only, on by default. A read only token can call no route that writes.
  • View and Edit permissions, limited to the permissions your own account holds. The lists are empty by default: pick the objects the integration needs, nothing more. The Edit list is disabled while Read only is on.
  • Allow list, optional: the addresses and networks (CIDR) the token may be used from. Leave it empty to allow any address.

Click Create. The next dialog shows the token string, once. Copy it with the copy button and store it in the caller's secret manager: the server keeps only a hash and cannot show it again. Click Done when the string is stored.

IMPORTANT

A lost token string cannot be recovered. Revoke the token and create a new one.

Edit a token ​

Use the pencil icon to change the name, the description, the allow list, or to pause the token with the Disabled switch. Scopes and expiry are fixed after creation: a token that needs more is a new token.

Revoke a token ​

Use the trash icon and confirm. The token is refused on every node within seconds. The record stays in the list, marked revoked, so that the audit trail keeps its owner and scopes until the retention period ends.

What the audit trail records ​

Every change made with a token appears in the log events with actorKind set to token and actorToken set to the token ID, next to your own account as the actor. Refused tokens and scope violations are events 6130 and 6131; see Log event IDs.