GalaxyGate Docs

Appearance

API tokens ​

An API token is a credential a script or tool uses to act on your behalf, so you never hand out your own login. If a token leaks, you delete it without changing your password.

There are two kinds. A personal token acts as you, the user. A workspace token belongs to the workspace itself. This page covers personal tokens first, then the extra choice you make for a workspace token.

Open the page from Security in the sidebar, then Tokens. It lives at the /tokens route.

Create a token ​

Select New token and fill in three things.

  • Name. A label so you can recognize the token later, such as deploy-bot or backup-script.
  • Expiry. When the token should stop working. The picker enforces a minimum of about 8 days and a maximum of about 1 year, so every token expires on its own but you cannot give one an arbitrarily short life. Pick a date that fits how long the automation needs it, and rotate before it lapses.
  • Permissions. A map of resource kinds, where you set each one to NONE, READ, or WRITE. This is how you scope the token: give it the least it needs and leave everything else at NONE. A read-only monitoring token should be READ on what it watches and NONE on the rest; a token that only powers instances on and off needs WRITE on instances and nothing more. (In the API request, this map is the grants field.)
The Tokens page with the New token button circled
Create a token from Security then Tokens (New token, circled).

Save the token the moment it is shown ​

The panel shows the plaintext value once. It is stored only as a hash, so we cannot show it again. Copy it right away and put it somewhere safe, such as your secret manager or your automation's environment.

You cannot recover a lost token

If you close the dialog without copying the token, or you lose it later, there is no way to read it back. Delete that token and create a new one.

Workspace tokens and scope ​

A workspace token acts on the workspace rather than as an individual user. When you create one, you also choose a Scope:

  • Workspace. The token applies across the whole workspace, subject to the None, Read, or Write permissions you set per resource kind.
  • Resource. The token is pinned to one specific resource. Pick this scope, then supply the resource ID it should be limited to.

Everything else works the same as a personal token: the permission map by resource kind, the one-time value, and the single Delete action.

Delete a token ​

Delete a token from the Tokens page when it is no longer needed or you suspect it leaked. The single Delete action stops it working and removes it from the list, so any script still using it is rejected immediately. Your own access is untouched.

Rotate on a schedule

Because you can create and delete tokens freely, rotate them: mint a new token, switch your automation over, then delete the old one. Built-in expiries make this a habit rather than an emergency.

Using a token in requests ​

A token goes in the Authorization header as a bearer token. The API section shows the exact header and full request examples.

API authentication