API tokens

Create, view and revoke Servor API tokens in Settings, and choose the scopes each token carries to keep automation least-privilege.

API tokens let scripts, integrations and automations talk to the Servor API on behalf of your team. This page shows how to create a token, why it's shown only once, which scopes to grant, and how to revoke a token you no longer trust.

Who can manage tokens

Creating and revoking API tokens is an admin capability. Members and viewers can't manage tokens — see roles and permissions. The public API also requires the AI plan; check plans and limits.

Create a token

Ready to go? Open API tokens in Servor and create one now.

Open Settings → API tokens

In the dashboard, go to Settings, then the API tokens tab — open it directly.

Start a new token

Click Create token and give it a clear name — for example incident-bot or status-sync. A descriptive name makes it easy to find and revoke later.

Choose scopes

Select only the scopes your integration actually needs. Grant incidents:write only to something that opens or updates incidents; leave the rest read-only. Least-privilege limits the blast radius if a token ever leaks.

Create and copy the token

Confirm to generate the token. It's displayed once. Copy it immediately and store it in a secret manager. Live tokens are prefixed sv_live_.

View a token — shown once

For your security, Servor shows the full token value only at creation. It is never displayed again, and there is no way to reveal it later.

Copy it now

If you close the dialog without copying the token, you can't recover it — you'll need to revoke it and create a new one. After creation, the token list shows only the name, its scopes, a masked prefix and the last-used time, never the secret itself.

Store tokens in a secret manager or your platform's environment variables. Never commit a token to a repository or ship it in client-side code.

Verify a token

Confirm a token works and see which team and scopes it carries with GET /v1/me:

curl https://api.servor.app/v1/me \
  -H "Authorization: Bearer sv_live_xxxxxxxxxxxx"

{ "teamId": "…", "tokenId": "…", "scopes": ["servers:read", "incidents:write"] }

See Authentication for how the Bearer header works.

Revoke a token

Revoke a token the moment it's no longer needed, or immediately if it may have leaked.

Open the token list

Go to Settings → API tokens and find the token by its name.

Revoke it

Click Revoke. The token stops working right away — any request using it then returns 401.

Rotate if needed

If a live integration relied on that token, create a replacement first, deploy the new value, then revoke the old one to avoid downtime.

Treat a leaked token as compromised

A token acts on behalf of your team within its scopes. If one is exposed in a log, a commit or a screenshot, revoke it immediately and issue a new one — don't wait to confirm misuse.

Best practices

One token per integration. Separate tokens make it safe to revoke a single one without breaking everything else.
Minimal scopes. Start read-only and add write access only where required.
Rotate periodically. Replace long-lived tokens on a schedule.
Watch the audit log. Token activity is recorded — review it via audit:read or the audit view in Servor.