Syncplify.me Server v8

Appearance

Automation tokens ​

Automation tokens are unattended credentials for the REST API, for scripts, orchestration tools and AI agents that manage the server without a person signing in. A SuperAdmin token is bound to your own SuperAdmin account, is read only unless you say otherwise, and needs a separate scope to change the service itself. The full model is described in Automation tokens in the Automation and AI agents chapter.

The feature needs a Professional or Ultimate license and is off until you enable it under Global Configuration. While it is off the page says so and the New token action is disabled; existing tokens stay listed and can be revoked.

The three tabs ​

  • My tokens: the tokens bound to your account, with edit and revoke.
  • All SuperAdmin tokens: every token of every SuperAdmin, with revoke.
  • Virtual sites: pick a site to see the tokens its Admins created, with the owner and the permissions each one carries, and revoke any of them. This is the oversight view: a site Admin cannot see the tokens of another Admin, you can see them all.

Each list shows the name and description, a status tag (active, expired, disabled or revoked), the scopes (read only or read and write, plus service actions when granted), the expiry date with the days left when fewer than fourteen remain, when and from which address the token was last used, and the size of its allow list. A filter box searches by name.

Create a token ​

Click New token. The dialog asks for a name (required) and an optional description, the expiry (required, within the policy maximum shown in the hint), Read only (on by default), Service actions (off by default, with a warning listing what it admits: restarting or draining nodes, starting and stopping sites, updating the software, renewing certificates, changing the license, terminating sessions), and an optional allow list of addresses and networks.

The next dialog shows the token string once. Copy it into the caller's secret manager and confirm that it is stored. The server keeps only a hash and cannot show it again.

IMPORTANT

Grant Service actions only to the integration that performs them, and never together with a long lifetime. A read only token covers monitoring and reporting; a read and write token without service actions covers configuration.

Edit, pause and revoke ​

The pencil icon changes the name, the description and the allow list, and pauses the token with the Pause switch; scopes and expiry are fixed after creation. The trash icon revokes a token after a confirmation: it is refused on every node within seconds, and the record stays, marked revoked, until the retention period of the policy ends.

Every change made with a token appears in the log events with actorKind set to token and actorToken set to the token ID. See Log event IDs, events 6130, 6131, 6211, 6212, 6213 and 7091.