Create and protect API access

Treat the token like a password

Export API tokens are bearer credentials. The raw value may be shown only once; Runekist stores a hash rather than the reusable secret.

1. Open Leadership → Access & sharing → API access.
2. Create one token for one integration where practical.
3. Copy it directly into the integration’s secure secret storage.
4. Verify the supported export call.
5. Revoke the token when it is no longer needed or might have leaked.

Never include a raw token in a screenshot, source repository, public chat, or support message.