> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stringboot.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

> Manage access tokens for SDKs

***

## Create API Token

API tokens authenticate your SDK requests to the Stringboot API.

<Steps>
  <Step title="Navigate to API Tokens">
    Go to **API Tokens** page (`/tokens`) from the sidebar
  </Step>

  <Step title="Select Application">
    Choose an application from the dropdown
  </Step>

  <Step title="Click New Token">
    Click the **New Token** button
  </Step>

  <Step title="Configure Token">
    Fill in the form:

    * **Token Name** (required, max 50 characters) - Descriptive name
    * **Token Type** - Select one:
      * **Standard** - Server-to-server API access
      * **Plugin** - Browser extensions/plugins (auto-bypass CORS)
    * **Expiry Date** (optional) - Set expiration for security
  </Step>

  <Step title="Create">
    Click **Create API Token** to generate
  </Step>

  <Step title="Copy Token">
    **IMPORTANT:** Copy the token from the dialog immediately

    The token is only shown once and cannot be retrieved later
  </Step>

  <Step title="Done">
    Click **Done** to close the dialog
  </Step>
</Steps>

<Warning>
  **Security Critical:** The token is displayed only once. Store it securely immediately after creation.
</Warning>

***

## Token Types

Choose the right token type for your use case:

<Tabs>
  <Tab title="Standard Token">
    **Use for:**

    * Mobile apps (iOS/Android)
    * Desktop applications
  </Tab>

  <Tab title="Plugin Token">
    **Use for:**

    * Figma Plugins
  </Tab>
</Tabs>

***

## View Tokens

The API Tokens page displays all your tokens with key information:

### Filter Tokens

<Steps>
  <Step title="Navigate to Tokens">
    Go to **API Tokens** page
  </Step>

  <Step title="Select Filter">
    Choose from dropdown:

    * **All Applications** - Show all tokens
    * **Specific App** - Filter by application
  </Step>
</Steps>

### Token Information

| Column          | Description                        |
| --------------- | ---------------------------------- |
| **Name**        | Token name you specified           |
| **Token**       | Masked token value (click to copy) |
| **Application** | Associated app name                |
| **Type**        | Standard or Plugin                 |
| **Status**      | Active or Revoked                  |
| **Created**     | Creation date                      |
| **Expiry**      | Expiration date (if set)           |
| **Actions**     | Copy, Revoke, Delete options       |

***

## Copy Token

Retrieve a token value to use in your application:

<Steps>
  <Step title="Find Token">
    Locate the token in the table
  </Step>

  <Step title="Click Copy">
    Click the **Copy** icon (clipboard)
  </Step>

  <Step title="Confirmation">
    Token copied to clipboard - paste in your SDK configuration
  </Step>
</Steps>

***

## Revoke Token

Disable a token without deleting it:

<Steps>
  <Step title="Navigate to Tokens">
    Go to **API Tokens** page
  </Step>

  <Step title="Find Token">
    Locate the token you want to revoke
  </Step>

  <Step title="Click Revoke">
    Click the **Revoke** icon (circular arrow)
  </Step>

  <Step title="Confirm">
    Confirm revocation in the dialog
  </Step>
</Steps>

<Warning>
  Revoked tokens cannot be reactivated. Create a new token if needed.
</Warning>

***

## Delete Token

Permanently remove a token:

<Steps>
  <Step title="Find Token">
    Navigate to **API Tokens** and find the token
  </Step>

  <Step title="Click Delete">
    Click the **Delete** icon (trash)
  </Step>

  <Step title="Confirm">
    Confirm deletion in the dialog
  </Step>
</Steps>

***

## Revoke All Tokens

Quickly revoke all tokens for a specific application:

<Steps>
  <Step title="Select Application">
    Choose a specific application from the dropdown (not "All Applications")
  </Step>

  <Step title="Click Revoke All">
    Click the **Revoke All** button at the top
  </Step>

  <Step title="Confirm">
    Confirm the action in the dialog
  </Step>
</Steps>

<Warning>
  This revokes **all active tokens** for the selected application. This action cannot be undone.
</Warning>

***

## Token Security Best Practices

<CardGroup cols={2}>
  <Card title="Descriptive Names" icon="tag">
    Use names that indicate:

    * Environment (Production, Staging, Dev)
    * Purpose (iOS App, Web Dashboard)
    * Date created (iOS Prod - Jan 2024)
  </Card>

  <Card title="Set Expiry Dates" icon="calendar">
    * Use expiry for enhanced security
    * Rotate tokens periodically
    * Set shorter expiry for high-risk environments
  </Card>

  <Card title="Revoke Unused Tokens" icon="ban">
    * Revoke tokens immediately when no longer needed
    * Clean up old tokens regularly
    * Review token list monthly
  </Card>

  <Card title="Store Securely" icon="vault">
    * Use environment variables
    * Never commit to version control
    * Use secret management tools
    * Encrypt in databases
  </Card>

  <Card title="Monitor Usage" icon="chart-line">
    * Track which tokens are in use
    * Monitor for unexpected activity
    * Rotate after security incidents
  </Card>
</CardGroup>

***

## Token Storage Examples

<Tabs>
  <Tab title="Environment Variables">
    ```bash .env theme={null}
    STRINGBOOT_API_TOKEN=std_1a2b3c4d5e6f7g8h9i...
    STRINGBOOT_BASE_URL=https://api.stringboot.com
    ```

    ```javascript theme={null}
    await StringBoot.initialize({
      apiToken: process.env.STRINGBOOT_API_TOKEN,
      baseUrl: process.env.STRINGBOOT_BASE_URL
    });
    ```
  </Tab>

  <Tab title="Android (BuildConfig)">
    ```kotlin build.gradle.kts theme={null}
    android {
        defaultConfig {
            buildConfigField("String", "STRINGBOOT_TOKEN",
                "\"${project.findProperty("STRINGBOOT_TOKEN") ?: ""}\"")
        }
    }
    ```

    ```kotlin Usage theme={null}
    StringbootExtensions.initialize(
        context = this,
        apiToken = BuildConfig.STRINGBOOT_TOKEN
    )
    ```
  </Tab>

  <Tab title="iOS (Info.plist)">
    ```xml Info.plist theme={null}
    <key>STRINGBOOT_API_TOKEN</key>
    <string>$(STRINGBOOT_API_TOKEN)</string>
    ```

    ```swift Usage theme={null}
    let token = Bundle.main.object(
        forInfoDictionaryKey: "STRINGBOOT_API_TOKEN"
    ) as? String ?? ""

    StringProvider.shared.initialize(apiToken: token)
    ```
  </Tab>
</Tabs>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Token Not Working">
    **Check:**

    * Token is active (not revoked)
    * Expiry date hasn't passed
    * Using correct application ID in requests
    * Token type matches use case (Standard vs Plugin)
    * Token copied correctly (no extra spaces)

    **Test with cURL:**

    ```bash theme={null}
    curl -H "Authorization: Bearer YOUR_TOKEN" \
         https://api.stringboot.com/api/strings/meta?appId=YOUR_APP_ID
    ```
  </Accordion>

  <Accordion title="401 Unauthorized Error">
    **Common causes:**

    * Token revoked or expired
    * Incorrect token format
    * Missing Bearer prefix
    * Wrong application ID

    **Solution:** Generate new token and verify configuration
  </Accordion>

  <Accordion title="CORS Issues with Standard Token">
    **If getting CORS errors:**

    * Use Plugin token type for browser-based apps
    * Or configure CORS on your backend
    * Standard tokens don't bypass CORS

    **For production web apps:** Use Plugin token or proxy through your backend
  </Accordion>

  <Accordion title="Lost Token After Creation">
    **If you didn't copy the token:**

    * Token cannot be retrieved again
    * Revoke the lost token
    * Create a new token
    * Copy immediately this time

    **Prevention:** Always copy tokens to secure storage immediately
  </Accordion>
</AccordionGroup>

***

## Quick Actions from Dashboard

From the main dashboard, quickly create tokens:

<CardGroup cols={2}>
  <Card title="Dashboard Shortcut" icon="gauge">
    Click **Generate API Token** on the dashboard
  </Card>

  <Card title="Tokens Page" icon="key">
    Use **New Token** button on `/tokens` page
  </Card>
</CardGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="SDK Quickstart" icon="rocket" href="/quickstart">
    Use your token in SDK integration
  </Card>

  <Card title="Web SDK Setup" icon="globe" href="/web-sdk/installation">
    Configure Web SDK with token
  </Card>

  <Card title="Android SDK" icon="android" href="/android-sdk/installation">
    Configure Android SDK with token
  </Card>

  <Card title="iOS SDK" icon="apple" href="/ios-sdk/installation">
    Configure iOS SDK with token
  </Card>
</CardGroup>