Token Expiry

Token expiry defines how long a portal-generated API Token remains valid for authenticating Smartflo API requests. Smartflo has updated the API Token validity model to provide better control over token lifecycle and security.

Previously, API Tokens were generated with a 10-year validity period. With the updated token model, newly generated portal tokens have a configurable expiry, allowing customers to select a validity period based on their integration requirements.

Token Expiry Options

For API Tokens generated from the Smartflo portal, the selected expiry period determines when the token will stop being valid. You can select one of the following expiry periods:

Example

If you generate a token on 11 August 2026 and select 30 Days, the token will remain valid for the configured period and will expire after the 30-day validity period. The exact expiry date and time can be viewed in the Expiry column of the API Token dashboard.

Existing API Token Expiry Update

Before the introduction of configurable expiry, API Tokens generated from the Smartflo portal had a 10-year validity period. As part of the API Token security enhancement, Smartflo has moved from the previous long-duration validity model to a configurable expiry model for newly generated tokens.

To transition existing tokens to the new expiry model, the validity of tokens created before 9 August 2026 has been updated to a fixed expiry date:

31 October 2026, 11:59:59 PM

These existing tokens will remain valid until the updated expiry date. After 31 October 2026, 11:59:59 PM, they will expire and will no longer work for API authentication.

Expired Token Retention

An expired API Token is not immediately removed from the Smartflo dashboard. After the token expires, it remains visible in the API Tokens dashboard for 14 days from the date of expiry.

This allows administrators to identify recently expired tokens before they are removed from the interface. Once the 14-day retention period is completed:

• The expired token is removed from the API Token dashboard.
• The token is no longer available in the Smartflo UI.
• The expired token cannot be used for API authentication.

Example

If a token expires on 31 October 2026, 11:59:59 PM, it will remain available in the dashboard for the defined 14-day period after expiry. After the 14-day retention period, it will no longer be displayed in the API Token UI.