Create and revoke API tokens

An API token lets a script, a pipeline, or the strackt CLI act in your workspace without your password. Each token is bound to the workspace you create it in and carries only the permissions you give it.

Tokens live under Settings → API tokens. Any member of a workspace can create tokens there. The list shows the tokens you created in the current workspace.

For how to call the API once you have a token, see the REST API. To connect the CLI, see Install the strackt CLI.

Create a token

1. Go to Settings → API tokens and choose Create token.
2. Give it a Token name you'll recognise later — for example, the pipeline or machine it's for.
3. Under What is this token for?, pick the option that matches how you'll use it. strackt fills in the permissions for you. Deploy from CI is selected to begin with.
4. Read the sentence under the options. It describes, in plain words, what the token will be able to do and what it won't.
5. Choose Create token.
6. Copy the token from the Copy this token now window.

What each option grants

Option	Meant for	What it grants	Highest tier
Monitoring and inventory	Dashboards, status checks, or syncing your fleet into another system.	Every Read permission, and nothing else	Read
Deploy from CI	GitHub Actions, GitLab CI, or any pipeline that ships your code.	Read applications, read checkpoints, and deploy	Change
The strackt CLI	Everyday work from your own terminal — everything the CLI can do.	Every permission except the three WordPress ones	Sensitive
Emergency maintenance	On-call access to apply server configuration and roll back to a checkpoint.	Read and write servers, read and restore checkpoints	Sensitive
Something else	Choose individual permissions yourself.	Nothing until you pick permissions	—

Each option carries a pill showing the highest tier it reaches, so you can see at a glance which ones hand over sensitive access.

The strackt CLI is deliberately close to full access, because the CLI can do almost everything you can. If a script only needs one job, pick a narrower option or build your own with Something else.

The three tiers

Every permission belongs to exactly one tier:

Tier	What it means
Read	Reads only — nothing here changes anything. Secret values stay masked; data your site holds does not.
Change	Creates, updates or removes the things you own. Nothing here reveals a credential or hands over a machine.
Sensitive	Reveals a credential, grants shell or arbitrary execution, or destroys server-level state.

Change is not the same as "reversible". Write Applications, for example, can delete an application — along with its stored secrets.

When you pick permissions with a consequence worth knowing about, a warning list appears above the summary before you create the token. Read the list: one Read permission is on it too, because running read-only WordPress commands can list your site's users and their email addresses.

See or change the full permission list

Choose Review the N permissions this grants below the summary to open the full list, grouped by tier. Each permission shows its name, what it allows, and any warning that goes with it. Each tier also has a Read everything, Change everything or Sensitive everything switch that turns on every permission in that section.

You can adjust the list from any starting option:

• Turn permissions on or off, and the option you chose shows a Modified pill. The summary switches to a count of how many permissions in each tier you've selected.
• Choose Something else to start from an empty list. You need at least one permission before Create token becomes available.

The permissions, by tier:

Tier	Permission	What it allows
Read	Read Servers	View server details, status, and configuration
Read	Read Applications	View application details, requirements, and domains
Read	Read Environment Variables	View environment variable keys and masked values
Read	Read Environment Secrets	View environment secret keys and masked values
Read	Read Checkpoints	View checkpoint history
Read	Read Services	View service details, state, and retirement blockers
Read	Run WordPress commands (read)	Run allowlisted read-only WP-CLI commands and view the update plan
Change	Write Servers	Modify server settings and trigger provisioning
Change	Write Applications	Create, update, and delete applications
Change	Write Environment Variables	Create, update, and delete environment variables
Change	Write Environment Secrets	Create, update, and delete environment secrets
Change	Deploy	Trigger deployments and rollbacks
Change	Run WordPress commands (write)	Run allowlisted safe write WP-CLI commands like cache flush
Change	Apply protected WordPress updates	Apply protected WordPress updates with an automatic restore point
Sensitive	Read Logs	View runtime, queue, scheduler, and PHP logs
Sensitive	Reveal Environment Variables	View plaintext environment variable values
Sensitive	Reveal Environment Secrets	View plaintext environment secret values
Sensitive	Run Commands	Run managed commands on application environments
Sensitive	Restore Checkpoints	Restore checkpoints to previous states
Sensitive	Retire Services	Retire services from managed servers
Sensitive	Manage Webhooks	Create, update, delete, and test webhook endpoints
Sensitive	Sign SSH Certificate	Request a short-lived SSH certificate for a server

Copy the token — it's shown once

After you create a token, the Copy this token now window opens with the token marked Shown once. Choose Copy token and store it somewhere safe, such as your CI provider's secret settings or a password manager.

strackt keeps only a hashed copy. Once you close the window, the token can't be displayed again. If you lose it, create a new token and delete the old one.

Check what a token can do later

Each token in the Registered tokens list shows:

• its name, and the option it was created for
• a pill for the highest tier it reaches
• when it was created, and when it was last used (or Never used)
• a sentence describing what it can do

That sentence is worked out from the token's actual permissions, so it stays accurate even if the options above change later.

A token with a Regenerate pill has lost some of the environment secret access it used to have. Create a replacement with the environment secret permissions it needs, then delete the old one.

Change a token's permissions

You can't edit a token after it's created. To change what a token can do, create a new one with the right permissions, switch your script or pipeline over to it, then delete the old one.

Revoke a token

1. In Registered tokens, choose Delete next to the token.
2. Confirm with Delete token.

Access is revoked immediately. Anything still using that token will be refused from its next request.