What API Token Self Service Capabilities Are Available?

CreativeX’s API token self service capability allows clients who have deployed the CreativeX Content API, Reporting API and/or Authentication Logging API to:

• Generate new tokens 
• Edit tokens
• Rotate tokens
• Revoke tokens

What are API tokens?

CreativeX provides you with access to a Content API, Reporting API and/or Authentication Logging API. These APIs enable you (our clients) and your partners to integrate CreativeX’s capabilities into their own environments. Each of these APIs rely on unique API tokens to authenticate and authorise requests, ensuring that only approved systems can interact with CreativeX data and services.

API tokens function as digital keys - any party possessing a valid token can access the API with the same permissions as the legitimate owner. Because of this, tokens must be treated like passwords and protected accordingly. If a token were to be stolen, leaked, or inadvertently shared, it could allow unauthorised access to your data or systems.

Generate a new API token

Create a new API token whenever you set up a new integration or grant access to a trusted system.

1. Navigate to Connections > API Tokens.

   

2. Select Generate Token.

   

3. Choose the appropriate API:
   • Content API,
   • Reporting API and/or
   • Authentication Logging API)
4. Enter the contact email address for the person responsible for the integration. CreativeX uses this email address to communicate important product updates, feature announcements, and API deprecation notices.
5. Enter an optional label to help identify the token.
6. Select the confirmation checkbox to acknowledge that you have authorization to create the token and understand that anyone with access to it can access CreativeX data.
7. Select Generate Token.
8. Copy and securely store both the API token and webhook secret. CreativeX displays these values only once.

Note: Reporting API tokens support optional access restrictions based on Resource Type, Markets, Brands, Channels, and Partners. Create the token first, then edit it to configure these restrictions.

Edit an API token

Edit an API token whenever you need to update its configuration or adjust its access permissions.

1. Navigate to Connections > API Tokens.
2. Locate the token in the Active tab.

3. Select the three-dot menu on the right side of the token.

   

4. Select Edit.

5. Update the available settings.

   

Note: Reporting API tokens support optional restrictions for Resource Type, Markets, Brands, Channels, and Partners.

Rotate an API token

Regular token rotation helps maintain strong security and supports your organization's security policies. Many organizations rotate API tokens every 90, 180, or 365 days, even when there is no indication of unauthorized access.

You should also rotate a token immediately if you believe someone has viewed, copied, or shared it without authorization.

1. Navigate to Connections > API Tokens.
2. Locate the token in the Active tab.

3. Select the three-dot menu.

   

4. Select Rotate.

   

5. Select Confirm & Rotate.

Important: Update every application, integration, or service that uses the previous token before you retire it.

Revoke an API token

Revoke an API token when it is no longer required or if you suspect unauthorized access. Revocation permanently disables the token and prevents any future API requests that rely on it.

1. Navigate to Connections > API Tokens.
2. Locate the token in the Active tab.

3. Select the three-dot menu.

   

4. Select Revoke.

   

5. Select Revoke Token to confirm.

Troubleshooting

• I cannot see the API Tokens menu.
  The API Token Self-Service capability may not be enabled for your organization. Contact CreativeX Support to request access.
• I forgot to copy the token or webhook secret.
  CreativeX displays these values only once. Generate a new token or rotate the existing token to obtain a new value.
• My integration stopped working after I rotated a token.
  Verify that every application and service now uses the newly generated token. Any system that still uses the previous token will lose access.
• I need to limit access to specific data.
  If you use the Reporting API, edit the token to restrict access by Resource Type, Markets, Brands, Channels, or Partners.

Please contact support@creativex.com if you have more questions