API Tokens
API tokens are scoped, workspace-level credentials for calling the Owlpane API on api.owlpane.com — for CI jobs, scripts, and internal tools. They are different from ingest keys:
| Credential | Prefix | Purpose |
|---|---|---|
| API token (personal access token) | owl_pat_ | Call the Owlpane API for automation. |
| Ingest key | owl_ing_ | Send telemetry to one project (write-only). |
Manage API tokens under Settings → API tokens (/settings/api-tokens). Owners and admins can create and revoke them.
Creating a token
- Open Settings → API tokens.
- Choose New token, give it a name (for example
CI nightly checks), and select the scopes your automation needs. - Copy the token immediately. It is shown once at creation — Owlpane stores only a hash, so a lost token cannot be recovered, only replaced.
Use the token as a bearer credential:
curl -H "Authorization: Bearer owl_pat_..." \
https://api.owlpane.com/v1/orgs/<orgId>/api-tokensScopes
Tokens carry a set of scopes; grant only what each automation needs:
| Scope | Grants |
|---|---|
observability:read | Read observability data |
observability:write | Write observability data |
alerts:read | Read alerts and channels |
alerts:write | Manage alerts and channels |
dashboards:read | Read dashboards |
dashboards:write | Manage dashboards |
members:read | Read workspace members |
members:write | Manage workspace members |
Limits
A workspace can have at most 10 active API tokens at a time. Revoke tokens you no longer use to stay within the limit.
Managing tokens
The token list shows each token's name, prefix, scopes, and last-used time. Revoke a token to invalidate it immediately.
| Operation | Endpoint |
|---|---|
| List tokens | GET /v1/orgs/:orgId/api-tokens |
| Create a token | POST /v1/orgs/:orgId/api-tokens |
| Revoke a token | DELETE /v1/orgs/:orgId/api-tokens/:tokenId |
Rotating a token
There is no rotate-in-place for credentials. To rotate, create a new token, move your automation to it, verify it works, then revoke the old token. The same principle applies to ingest keys — see Projects & Keys.
Scope examples
Grant the smallest set that lets the automation work:
| Automation | Suggested scopes |
|---|---|
| Read-only reporting script | observability:read |
| CI job that annotates dashboards | observability:read, dashboards:write |
| Tool that creates and updates alert rules | alerts:read, alerts:write |
| Internal admin tooling | Add members:read / members:write only if it truly needs them |
Security
- Store tokens in a secrets manager. Treat a token like a password; anyone who holds it can act with its scopes.
- Tokens are shown once. Owlpane stores only a hash, so a token cannot be displayed again after creation.
- Revoke promptly. A revoked token is rejected immediately; revoke any token you no longer use to stay within the 10-active-token limit.
- Prefer scoped tokens over shared ones. Issue one token per automation so you can revoke access narrowly.
Related
- Projects & Keys — ingest keys and the tenancy model.
- Ingest Keys & Authentication — how ingest keys are passed.
- API reference — request and response shapes.
Last updated