Token Expiry

Token expiry defines how long a portal-generated API Token remains valid for authenticating Smartflo API requests. Smartflo has updated the API Token validity model to provide better control over token lifecycle and security.

With the updated token model, newly generated portal tokens have a configurable expiry, allowing customers to select a validity period based on their integration requirements.

Token Expiry Options

For API Tokens generated from the Smartflo portal, the selected expiry period determines when the token will stop being valid. You can select one of the following expiry periods:

Example

If you generate a token on 11 August 2026 and select 30 Days, the token will remain valid for the configured period and will expire after the 30-day validity period. The exact expiry date and time can be viewed in the Expiry column of the API Token dashboard.

Existing API Token Expiry Update

As part of the API Token security enhancement, the expiry date for existing API Tokens created before 9 August 2026 was initially set to 31 October 2026, 11:59:59 PM.

To provide customers with additional time to implement the Token Rotation API and update their integrations, Smartflo has extended the expiry date of these existing tokens.

The revised expiry date for these existing API Tokens is 31 January 2027, 11:59:59 PM.

These tokens will remain valid until the revised expiry date. After 31 January 2027, 11:59:59 PM, they will expire and will no longer work for API authentication.

Refer to the Token Rotation documentation for details on implementing the Token Rotation API.

ken Retention

An expired API Token is not immediately removed from the Smartflo dashboard. After the token expires, it remains visible in the API Tokens dashboard for 14 days from the date of expiry.

This allows administrators to identify recently expired tokens before they are removed from the interface. Once the 14-day retention period is completed:

• The expired token is removed from the API Token dashboard.
• The token is no longer available in the Smartflo UI.
• The expired token cannot be used for API authentication.

Example

If a token expires on 31 October 2026, 11:59:59 PM, it will remain available in the dashboard for the defined 14-day period after expiry. After the 14-day retention period, it will no longer be displayed in the API Token UI.