Create, Test and Revoke Scoped API Tokens

Before Creating a Credential

• Identify the external system owner, purpose, required branches and exact records it must read or change.
• Create one token per integration. Never share a general token between accounting, ecommerce and custom scripts.
• Prefer Read only. Add Write or Delete only when the integration has a tested operational need.
• Choose who will store, rotate and revoke the secret before minting it.

Create the Token

1. Open Manage -> Integrations -> API Tokens and click New Token.
2. Enter a recognizable name such as Accounting sync - read only.
3. In the scope matrix, tick only the required Read, Write or Delete cells.
4. Select at least one permission; Posnic refuses an empty token.
5. Click Create Token.
6. Copy the plaintext token from the reveal box immediately. It is displayed once and cannot be recovered from the list.
7. Store it in the receiving system's secret manager, not in email, chat, source code or a shared document.

Available Scope Modules

Security Boundaries

• Token scopes cannot grant till-action approvals, settings access or plan controls.
• The token inherits the creating administrator's licence and branch access; it is not a cross-shop master key.
• Posnic stores a SHA-256 hash and a short hint, not the plaintext secret.
• The list shows Name, token hint, scopes, Last Used and Action. Last Used is updated on active use and may be throttled for several minutes.

Test and Revoke

1. Test the smallest permitted read against a non-production or low-risk record.
2. Confirm an ungranted action is rejected; this proves the scope boundary as well as connectivity.
3. Return to API Tokens and confirm Last Used updates.
4. When replacing or retiring an integration, create and test the replacement first, then revoke the old token.
5. Treat a lost or exposed token as compromised and revoke it immediately. Revocation marks it inactive; future authentication fails closed.