Using & Managing API Tokens

Once an API Token is generated, it can be used to authenticate Smartflo API requests. The API Tokens dashboard also provides a centralized view of the tokens created for your account, allowing you to monitor their status, expiry, access controls, and manage them as required.

Request Header

Authorization: Bearer <API_TOKEN>

Replace <API_TOKEN> with the API Token generated from the Smartflo portal.

Example

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.xxxxxxxxx

The token must be included in every API request that requires authentication.

Viewing API Tokens

To view your existing API Tokens:

1. Log in to the Smartflo portal.
2. Go to API Connect → API Tokens.
3. The API Tokens dashboard displays the tokens created for your account.

The dashboard provides information such as:

Searching for a Token

If multiple API Tokens are configured, use the Search field available on the API Tokens page to quickly locate a token. You can search using the available token identification information, such as the Token Name.

Monitoring Token Expiry

The Expiry column displays the configured expiry date and time of each token. Use this information to identify tokens that are approaching expiry and plan token rotation in advance. For detailed information about token validity and expiry behavior, see Token Expiry.

Managing Access Controls

The API Tokens dashboard displays the access controls configured for each token.

For example:

• IP – IP Restriction is enabled.
• SCOPE – Scope Restriction is enabled.
• NONE – No additional access control is configured.

Access-control configuration determines where the token can be used and which Smartflo APIs it can access. For detailed information, see Access Control.

Blacklisting an API Token

If a token is no longer required or you suspect that a token has been compromised, it can be blacklisted from the API Token management options.

A blacklisted token can no longer be used to authenticate API requests.

Token Rotation

For production integrations, periodically replace API Tokens rather than relying on a single token indefinitely.

A typical token-rotation process is:

Generate New Token → Update Application → Test API Requests → Retire/Blacklist Old Token

When rotating a token:

• Generate a new token with the required configuration.
• Update the application or integration with the new token.
• Test the integration to confirm that API requests are successful.
• Once the new token is confirmed to be working, blacklist the old token if it is no longer required.

This approach helps prevent service interruption while maintaining secure token management.

Handling an Expired Token

An expired token cannot be used to authenticate Smartflo API requests. If your application receives an authentication failure because the token has expired:

• Generate a new API Token.
• Configure the required expiry and access controls.
• Update the application with the new token.
• Test the API integration.
• Retire the expired or old token as applicable.

Handling Existing Legacy Tokens

API Tokens created before 9 August 2026 previously had a 10-year validity period. Their expiry has now been updated to:

31 October 2026, 11:59:59 PM

If your application is using one of these tokens, generate a new token and update the application before the updated expiry date.