API Tokens

An API token lets a script, integration or other tool call the DocStar API on behalf of your workspace, without signing in. Each token belongs to one workspace and is created by its Owner.

#

Who can create tokens

Only the workspace Owner can create API tokens. Admins and Members don't see the Auth Key option in the workspace menu.

A token gives full access to the collections in the workspace it was created in, so share it only with tools you trust.

#

Create a token

  1. Click your workspace name at the bottom of the left sidebar.
  2. Click Auth Key. The API Token Management page opens.
  3. Under Generate New Token, enter a Token Name that tells you what the token is for, such as "CI pipeline" or "Zapier".
  4. Click Generate Token.

image (2).png

  1. In Token Generated Successfully, click the copy button to copy the token. Use the eye button if you want to see the full value.
  2. Store the token somewhere safe, such as a password manager or your tool's secret settings, then click Close.

image (1).png

This is the only time you'll see the token. DocStar stores only a secure fingerprint of it. If you lose it, revoke it and create a new one.

#

Use the token in API requests

Send the token in the Authorization header of each request:

Authorization: Bearer hm_your_token
  • Every DocStar API token starts with hm_.
  • The Bearer prefix is recommended. DocStar also accepts the token on its own.
  • If the token is wrong or revoked, the API answers with 403 and the message "Invalid API token".
#

Limits

Limit Value
Active tokens per Owner, per workspace 5
Token names Must be unique among your tokens in that workspace, including revoked ones
Expiry Tokens don't expire. They work until you revoke them.

To create a sixth token, revoke one you no longer use first.

#

View your tokens

The Your API Tokens list shows each token's Name, Status (Active or Revoked), when it was Created and when it was Revoked. The token value itself is never shown again.

#

Revoke a token

Revoke a token when a tool no longer needs it, when someone who had it leaves, or if you think it was exposed.

  1. Open Auth Key from the workspace menu.
  2. In Your API Tokens, click Revoke next to the token.
  3. Click Revoke Token to confirm.

image (4).png

The token stops working immediately, and any app using it loses access. This can't be undone.

#

Keep tokens safe

  • Treat tokens like passwords. Never paste them in public docs, chats or code repositories.
  • Create one token per tool, so you can revoke one without breaking the others.
  • Give tokens clear names so you know what will break when you revoke one.
  • Tokens belong to one workspace. Create a separate token in each workspace you want to reach.
Built with DocStar