{"id":17219,"date":"2026-08-14T18:56:56","date_gmt":"2026-08-14T18:56:56","guid":{"rendered":"https:\/\/www.onflo.com\/learningcenter\/?p=17219"},"modified":"2026-08-14T18:56:56","modified_gmt":"2026-08-14T18:56:56","slug":"api-tokens","status":"publish","type":"post","link":"https:\/\/www.onflo.com\/learningcenter\/how-to-articles\/api-tokens\/","title":{"rendered":"API Tokens"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
How customers create and manage the tokens that let their software connect to the Onflo API<\/span><\/em><\/h5>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Overview<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

API Tokens<\/b> is a feature in Onflo Settings that lets a customer generate a secure key which their own software can use to connect to the Onflo API. Onflo describes it on the page itself as: \u201cAPI tokens authenticate your applications when making API requests. Generate tokens with custom expiration dates and manage their lifecycle securely.\u201d<\/span><\/p>

In everyday terms: if a customer wants their own system (a student information system, an HR platform, a reporting tool, or a script their IT team wrote) to create tickets in Onflo or look up assets automatically, that system needs a way to prove it is allowed to do so. The API token is that proof. The customer generates it once inside Onflo, hands it to whoever is building the connection, and their software includes it with every request it sends to Onflo.<\/span><\/p>

You will find the feature under <\/span>Settings \u2192 Integration Hub \u2192 API Tokens<\/b>.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Key Terms<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

You do not need to be technical to support this feature, but you will hear these words in tickets and on calls. Here is what each one actually means, with an everyday comparison.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
API<\/i><\/b><\/h5>

Short for <\/span>Application Programming Interface<\/b>. It is a service counter that one piece of software uses to talk to another. A person uses the Onflo screens; a piece of software uses the Onflo API. Same building, different door.<\/span><\/p>

Example:<\/b> a school district\u2019s student system wants to raise an Onflo ticket automatically every time a new laptop is issued. Nobody types it in. The student system sends a message through the Onflo API and the ticket appears.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
API token<\/i><\/b><\/h5>

A long secret string of characters that acts as a key. It is what proves the request is coming from someone allowed to use that Onflo account.<\/span><\/p>

Example:<\/b> think of a hotel keycard. The scanner at the door does not check your face or your name; it only checks that the card is genuine and has not expired. An API token works the same way \u2014 and just like a keycard, anyone holding it can get in, so it must not be shared casually.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Bearer token<\/i><\/b><\/h5>

The way the token is attached to a request. \u201cBearer\u201d literally means \u201cwhoever bears (carries) this\u201d. The Onflo API documentation shows the authorisation type as <\/span>Bearer Token<\/b>.<\/span><\/p>

Example:<\/b> a cinema ticket. The usher does not care who bought it \u2014 whoever is holding it gets a seat. This is exactly why a leaked token is a real problem, and why Onflo lets customers expire, deactivate, or delete one.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Endpoint<\/i><\/b><\/h5>

One specific thing the API can do, each with its own web address. The Onflo API groups its endpoints into two areas: <\/span>Tickets<\/b> and <\/span>Assets (IT Asset Management)<\/b>.<\/span><\/p>

Example:<\/b> the same office building has different counters \u2014 one to raise a ticket (\u201cCreate Ticket\u201d), one to search for a laptop (\u201cSearch Asset\u201d). Each counter is an endpoint. The token gets you into the building; the endpoint is which counter you walk up to.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Request and response<\/i><\/b><\/h5>

A <\/span>request<\/b> is the message the customer\u2019s software sends to Onflo. A <\/span>response<\/b> is what Onflo sends back \u2014 for example a confirmation that reads \u201cTicket created successfully.\u201d<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Header<\/i><\/b><\/h5>

Information written on the outside of the request rather than inside the message itself. The token travels in a header.<\/span><\/p>

Example:<\/b> the address and stamp go on the outside of the envelope; the letter goes inside. The token is on the envelope.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Why every token starts with \u201ceyJhbGci\u2026\u201d<\/i><\/b><\/h5>

Onflo tokens use a standard technical format (a JSON Web Token, often shortened to <\/span>JWT<\/b>). Every token of this type begins with the same few characters, which is why the Identifier column on the API Tokens page shows \u201ceyJhbGci\u2026\u2026\u201d for every row. It is not an error and it does not mean two tokens are the same \u2014 it is just the shared beginning of the format, in the same way that every UK phone number starts with a zero.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Expiry<\/i><\/b><\/h5>

The date the token stops working. Onflo requires every token to have one, and offers <\/span>30 days<\/b>, <\/span>60 days<\/b>, <\/span>90 days<\/b>, or a <\/span>Custom<\/b> date.<\/span><\/p>

Example:<\/b> a hotel keycard programmed to stop working at checkout. If it is lost after that, it is harmless.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Masked<\/i><\/b><\/h5>

Hidden so it cannot be read back. After a token is saved, Onflo shows only the harmless beginning of it and permanently hides the rest.<\/span><\/p>

Example:<\/b> a bank statement showing only the last four digits of a card number. Enough to recognise which card it is, not enough to spend money.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Postman and the Onflo API Hub<\/i><\/b><\/h5>

Postman<\/b> is a widely used tool that developers use to try out an API by hand before wiring it into their own software. Onflo publishes its API documentation in a Postman-style catalogue at <\/span>apihub.onflo.com<\/b>, which is where a customer\u2019s developer goes to see what the API can do.<\/span><\/p>

Example:<\/b> a test kitchen. You try the recipe there before putting it on the restaurant menu.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
cURL<\/i><\/b><\/h5>

A single line of text that sends one request to an API. The Onflo API Hub shows a ready-made cURL example for every endpoint so a developer can copy it, paste in their token, and see it work immediately. If a customer sends you something starting with \u201ccurl --location \u2026\u201d, that is what it is.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Key Features<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t