API Tokens - Stringboot

Create API Token

API tokens authenticate your SDK requests to the Stringboot API.

Navigate to API Tokens

Go to API Tokens page (/tokens) from the sidebar

Select Application

Choose an application from the dropdown

Click New Token

Click the New Token button

Configure Token

Fill in the form:

Token Name (required, max 50 characters) - Descriptive name
Token Type - Select one:
- Standard - Server-to-server API access
- Plugin - Browser extensions/plugins (auto-bypass CORS)
Expiry Date (optional) - Set expiration for security

Create

Click Create API Token to generate

Copy Token

IMPORTANT: Copy the token from the dialog immediatelyThe token is only shown once and cannot be retrieved later

Done

Click Done to close the dialog

Security Critical: The token is displayed only once. Store it securely immediately after creation.

Token Types

Choose the right token type for your use case:

Standard Token
Plugin Token

Use for:

Mobile apps (iOS/Android)
Desktop applications

View Tokens

The API Tokens page displays all your tokens with key information:

Filter Tokens

Navigate to Tokens

Go to API Tokens page

Select Filter

Choose from dropdown:

All Applications - Show all tokens
Specific App - Filter by application

Token Information

Column	Description
Name	Token name you specified
Token	Masked token value (click to copy)
Application	Associated app name
Type	Standard or Plugin
Status	Active or Revoked
Created	Creation date
Expiry	Expiration date (if set)
Actions	Copy, Revoke, Delete options

Copy Token

Retrieve a token value to use in your application:

Find Token

Locate the token in the table

Click Copy

Click the Copy icon (clipboard)

Confirmation

Token copied to clipboard - paste in your SDK configuration

Revoke Token

Disable a token without deleting it:

Navigate to Tokens

Go to API Tokens page

Find Token

Locate the token you want to revoke

Click Revoke

Click the Revoke icon (circular arrow)

Confirm

Confirm revocation in the dialog

Revoked tokens cannot be reactivated. Create a new token if needed.

Delete Token

Permanently remove a token:

Find Token

Navigate to API Tokens and find the token

Click Delete

Click the Delete icon (trash)

Confirm

Confirm deletion in the dialog

Revoke All Tokens

Quickly revoke all tokens for a specific application:

Select Application

Choose a specific application from the dropdown (not “All Applications”)

Click Revoke All

Click the Revoke All button at the top

Confirm

Confirm the action in the dialog

This revokes all active tokens for the selected application. This action cannot be undone.

Token Security Best Practices

Descriptive Names

Use names that indicate:

Environment (Production, Staging, Dev)
Purpose (iOS App, Web Dashboard)
Date created (iOS Prod - Jan 2024)

Set Expiry Dates

Use expiry for enhanced security
Rotate tokens periodically
Set shorter expiry for high-risk environments

Revoke Unused Tokens

Revoke tokens immediately when no longer needed
Clean up old tokens regularly
Review token list monthly

Store Securely

Use environment variables
Never commit to version control
Use secret management tools
Encrypt in databases

Monitor Usage

Track which tokens are in use
Monitor for unexpected activity
Rotate after security incidents

Token Storage Examples

Environment Variables
Android (BuildConfig)
iOS (Info.plist)

.env

STRINGBOOT_API_TOKEN=std_1a2b3c4d5e6f7g8h9i...
STRINGBOOT_BASE_URL=https://api.stringboot.com

await StringBoot.initialize({
  apiToken: process.env.STRINGBOOT_API_TOKEN,
  baseUrl: process.env.STRINGBOOT_BASE_URL
});

build.gradle.kts

android {
    defaultConfig {
        buildConfigField("String", "STRINGBOOT_TOKEN",
            "\"${project.findProperty("STRINGBOOT_TOKEN") ?: ""}\"")
    }
}

Usage

StringbootExtensions.initialize(
    context = this,
    apiToken = BuildConfig.STRINGBOOT_TOKEN
)

Info.plist

<key>STRINGBOOT_API_TOKEN</key>
<string>$(STRINGBOOT_API_TOKEN)</string>

Usage

let token = Bundle.main.object(
    forInfoDictionaryKey: "STRINGBOOT_API_TOKEN"
) as? String ?? ""

StringProvider.shared.initialize(apiToken: token)

Troubleshooting

Token Not Working

Check:

Token is active (not revoked)
Expiry date hasn’t passed
Using correct application ID in requests
Token type matches use case (Standard vs Plugin)
Token copied correctly (no extra spaces)

Test with cURL:

curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://api.stringboot.com/api/strings/meta?appId=YOUR_APP_ID

401 Unauthorized Error

Common causes:

Token revoked or expired
Incorrect token format
Missing Bearer prefix
Wrong application ID

Solution: Generate new token and verify configuration

CORS Issues with Standard Token

If getting CORS errors:

Use Plugin token type for browser-based apps
Or configure CORS on your backend
Standard tokens don’t bypass CORS

For production web apps: Use Plugin token or proxy through your backend

Lost Token After Creation

If you didn’t copy the token:

Token cannot be retrieved again
Revoke the lost token
Create a new token
Copy immediately this time

Prevention: Always copy tokens to secure storage immediately

Quick Actions from Dashboard

From the main dashboard, quickly create tokens:

Dashboard Shortcut

Click Generate API Token on the dashboard

Tokens Page

Use New Token button on /tokens page

Next Steps

SDK Quickstart

Use your token in SDK integration

Web SDK Setup

Configure Web SDK with token

Android SDK

Configure Android SDK with token

iOS SDK

Configure iOS SDK with token

Getting Started

Android SDK

iOS SDK

Web SDK

Dashboard

​Create API Token

​Token Types

​View Tokens

​Filter Tokens

​Token Information

​Copy Token

​Revoke Token

​Delete Token

​Revoke All Tokens

​Token Security Best Practices

Descriptive Names

Set Expiry Dates

Revoke Unused Tokens

Store Securely

Monitor Usage

​Token Storage Examples

​Troubleshooting

​Quick Actions from Dashboard

Dashboard Shortcut

Tokens Page

​Next Steps

SDK Quickstart

Web SDK Setup

Android SDK

iOS SDK

Create API Token

Token Types

View Tokens

Filter Tokens

Token Information

Copy Token

Revoke Token

Delete Token

Revoke All Tokens

Token Security Best Practices

Token Storage Examples

Troubleshooting

Quick Actions from Dashboard

Next Steps