# Managing access tokens

Source: https://docs.arcxp.com/en/products/arc-xp-administration/developer-center/managing-access-tokens.html

Use Developer Center to create, manage, or delete your organization’s developer API access tokens.

The access tokens _do not expire_ , but administrators can revoke them depending on the project’s progress.

## Prerequisites

To use the Developer Center application, you need the following:

- administrator privileges
- Know which Arc XP APIs and environments your developers need to access.

## Scenario: Granting access to Arc XP’s Author API to a new member

An administrator of The Herald, an organization using Arc XP’s implementation, wants to create a new access token for a junior developer who recently joined.

During the first weeks, they provide a **Read only** **Restricted access** token, allowing the developer to access the Author API and create author profiles.

After six months, the administrator revokes the developer’s access token after their assignment ends.

From the **Access Tokens** page, the administrator can also search, manage, and remove their team access tokens.

## Procedures

## Creating a new access token

To create new access tokens for your developers, complete the following:

1. Navigate to **Developer Center**. The **Access Tokens** page opens.
2. Click **New access token**. The **New access token** window opens.
3. Select the access token type from the following:

  - **Restricted access** \- use this access type to create tokens with permissions for specific API endpoints. These tokens can be shared with your developers as needed.  
  Tokens remain active even if a developer leaves your company, so manage token access separately from developer access.
  - **Read only (admin)** \- use this access type to give administrators _only_ read privileges.
  - **All access (admin)** \- use this access type to grant administrators full writing and reading privileges for all Arc XP API endpoints.  
ImportantWe recommend leveraging restricted access tokens for all cases.
4. Click **Create token** to confirm your choice or **Cancel** to stop the creation process.

Access tokens are visible only one time _after creation_. Store your access tokens in a secure place, such as your password manager for further reference.

## Creating restricted access tokens

Restricted access tokens are scoped to specific Arc XP applications and the recommended security solution for all scenarios. They allow you to have granular control over who can access your services, increasing your organization’s security by minimizing potential risks if a token is ever compromised.

To create a **Restricted access token**, complete the following from the **New access token** pane:

1. Select **Restricted access** as the token type.
2. Click **Create token**. The **Create restricted access token** page opens.
3. Enter a **Token description** to help users understand what this token is for.
4. In the **Configure endpoint access** section, select the token’s access level for each Arc XP application from **None**, **Read Only**, or **Full Access**.
5. In the upper right corner, click **Generate token**. The **Generated restricted access token** page opens.
6. Copy the generated access token and store it in your password manager for further reference.

> **Caution:**
> 
> You cannot modify a restricted access token after it is created. You must create a new restricted access token to change the permissions.

## Creating a Read only (admin) token

Read only (admin) access tokens provide users with read-only access to components from all Arc XP APIs, including internal notes, unpublished content, and user details.

To create a **Read only (admin)** token, complete the following from the **New access token** pane:

1. Select **Read only (admin)** as the token type.
2. Click **Create token**. The **Create read-only token** page opens.
3. Enter a **Token description** to help users understand what this token is for.
4. In the upper right corner, click **Generate token**. The **Generated restricted access token** page opens.
5. Copy the generated access token and store it in your password manager for further reference.

## Creating an All access (admin) token

All access (admin) tokens grant complete access to all Arc XP API endpoints. These tokens are useful for applications that programmatically generate, ingest, or modify content in Arc XP without human intervention.

To create an **All access (admin)** token, complete the following from the **New access token** pane:

1. Select **All access (admin)** as the token type.
2. Click **Create token**. The **Create all access token** page opens.
3. Enter a **Token description** to help users understand what this token is for.
4. In the upper right corner, click **Generate token**. The **Generated all access token** page opens.
5. Copy the generated access token and store it in your password manager for further reference.

## Revoking an access token

You can revoke access tokens as your project needs them. However, you must manually revoke access tokens when a user account is removed from Okta or when a user leaves your organization.

Revoking an access token _cannot_ be undone.

1. In the search box, filter the tokens by description or username.
2. Click ![icon_ellipsis.png](https://docs.arcxp.com/images/learning-center/image/img-36e988534106c557aab2119deabbbed2.png) \> **Revoke Token**. The **Revoke access toke** confirmation message opens.
3. Click **Revoke access token**.

> **Tip:**
> 
> Rotate tokens regularly. Create new tokens and revoke old ones after deploying your application to production environments to minimize the time a compromised token can be exploited.