API Tokens

API tokens let integrations and custom applications access your Syncro account. Each token has its own permissions and expiration, so an integration can access only the data and actions you allow, for only as long as you allow. Syncro shows the full token only once, when you create it.

This document describes how to generate and manage API tokens for native integrations and custom integrations.

Note: API Tokens are used in the same way that API Keys were used before. If an integration is asking for a Syncro API Key, you will use these API Tokens going forward.

Generate New API Tokens

To generate a new API Token, follow these steps:

1. Navigate to Admin > API - API Tokens. The API Tokens table displays.
2. In the upper right, click +New Token:
   
3. On the New Token page, select either the App Integration or Custom Permissions tab:
   
   • App Integration: Creates a pre-built API token for our native integrations.
   • Custom Permissions: Allows you to define your own permissions for the API token.
4. If you selected App Integration: 
   1. Click Create Token next to the desired app. 
   2. In the Confirm Permissions window, optionally update the Name and/or adjust which permissions are being granted. 
   3. Click Create API Token.
   4. Copy the API Key that's displayed: 
      
      IMPORTANT: This is your one opportunity to capture this information so do it carefully.
   5. Click Done. The API Tokens table displays a new row for your token.
5. If you selected Customer Permissions:
   1. Give your token a Name and an Expiration Date. (See also: About Token Expiration.)
   2. Check the boxes next to any individual permissions you want to grant. Or, select the box for an entire category of permissions:
   3. Click Create API Token.
   4. Copy the API Key that's displayed: 
      
      IMPORTANT: This is your one opportunity to capture this information so do it carefully.
   5. Click Done. The API Tokens table displays a new row for your token.

About Token Expiration

Every API token has an expiration setting. An expiration controls how long a token works and is a security best practice. When a token expires, Syncro no longer accepts it, and integrations that use it stop working until you replace the token.

Set the expiration in the Expiration field when you create a token. You can always change it later.

The API Tokens page color codes each token's expiration so you can see which tokens are expiring soon or have expired:

• No Expiration: A green checkmark with the text “Indefinite.”
• Expiring Soon: A yellow warning with the upcoming date of expiration.
• Expired: A red exclamation circle with the date of expiration.

Manage Existing API Tokens

The API Tokens page displays a table showing each token with its Name, Type, Last Accessed (date), Expiration, and Owner:

For existing tokens, you can click the vertical ellipsis and take the following actions:

• Edit: Click this button to open the Edit Token page, which allows you to rename, update the expiration date, or modify the permissions for the token:
  
  When finished, be sure to click Update API Token.
• Duplicate: Click this button to create a copy of the token and its permissions.
• Take Ownership: Click this button to take ownership of the token. This may be useful when disabling a user (e.g. to offboard an employee). 
• Delete: Click this button to remove/revoke the token.

About Calendar Tokens

Calendar Tokens let you view your Syncro calendar in another application. 

You cannot create a Calendar Token from +New Token. Instead, create Calendar Tokens from the Calendar page. (See also: About the Calendar Tab/Page.) 

Calendar Tokens have a fixed scope. When you edit a Calendar Token, a note about the fixed scope appears in place of the permission checkboxes.

By default, each Calendar Token appears in the API Tokens table with the Name “Calendar Sync URL,” the Type set to “Calendar ICS Feed,” and the Expiration set to Indefinite.