---
title: Managing personal API tokens
summary: null
url: >-
https://www.fastly.com/documentation/guides/organizations-and-accounts/personal-user-profiles/managing-your-personal-api-tokens
---
API tokens are unique security credentials for API activities you initiate as an individual. They let you prove your identity to Fastly so you can access restricted resources and perform specific operations via the [Fastly API](https://www.fastly.com/documentation/reference/api/). Within the Fastly control panel, you'll see them referred to as "user tokens." This guide covers how to create, view, and delete them. You'll also find information about token scopes, limitations, and best practices for managing them safely.
> **NOTE:** If you need API tokens for non-human clients like automation scripts and deployment pipelines, check out [Managing account-level API tokens](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-members-and-permissions/managing-account-level-api-tokens) for information about automation tokens.
## Creating a user token
> **IMPORTANT:** Be sure you're creating tokens for the right account. If you've been invited as a user on multiple company accounts, you'll need to [switch to the appropriate account](https://www.fastly.com/documentation/guides/organizations-and-accounts/personal-user-profiles/logging-in-and-switching-between-fastly-accounts#switching-between-company-accounts) first.
To create a user token:
To create a user token:
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Account** > **API tokens** > [**Personal tokens**](https://manage.fastly.com/account/personal/tokens).
3. Click **Create token**.
4. When prompted, enter your password to re-authenticate your permissions.
5. Fill out the **Create a Token** fields as follows:
- In the **Name** field, enter a descriptive name for the token that indicates how or where it will be used.
- _(Optional)_ When visible, leave the **Type** option set to **User token**. These controls only appear when you've been assigned the role of superuser.
- From the **Scope** options, select one or more checkboxes to limit the token's access to a [specific scope](https://www.fastly.com/documentation/guides/organizations-and-accounts/personal-user-profiles/managing-your-personal-api-tokens#token-scopes). Only the Scope options applicable to your role will be selectable. Our guide to [configuring user roles and permissions](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-members-and-permissions/about-user-roles-and-permissions) provides more information.
- From the **Access** options, select either all services or limit the token's access to a specific service or group of services by selecting them from the **Search or select service** menu.
- From the **Expiration** options, set the token expiration timeframe. By default the control panel will set the expiration date to 90 days from the date on which you create it. You can, however, set a token to never expire or you can select a specific date on which it expires.
> **IMPORTANT:** After a token expires, using it for any request will return an HTTP 401 response.
6. Click **Create Token** to create the new token. A new token and its creation notification appears. This is the credential you'll use to authenticate via the Fastly API. You may use the same token for multiple applications.
7. Click the clipboard 
to copy the API token string so you can store it in a safe, secret location.
> **WARNING:** This is the only time your API token string will be visible. Be sure to immediately copy it and store it in a safe location. It will never be visible again.
8. Click **Okay**.
## Viewing your user tokens
To view your personal user tokens:
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Account** > **API tokens** > [**Personal tokens**](https://manage.fastly.com/account/personal/tokens). The API tokens page appears with a list of your personal tokens.
## Deleting a user token
> **WARNING:** Deleting an API token will break any integration actively using that credential.
To delete a user token you've created:
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Account** > **API tokens** > [**Personal tokens**](https://manage.fastly.com/account/personal/tokens).
3. Find the token you want to delete and click the trash 
.
4. Click **Delete** to permanently delete the user token.
## Best practices
* __Keep it secret. Keep it safe.__ Anyone with your API token can add and delete data as you, so treat it with the same care as a password.
* __Use descriptive names.__ Use enough words in the name field to make the token's purpose clear months later. Something like "GitLab CI deployment token for staging" is more useful than "test token."
* __Store tokens securely.__ Store tokens in a password manager, secret vault, or environment variables. Never commit them to a code repository or store them in plain text config files. You can only copy a token's string once, at creation, so capture it immediately.
* __Use the least privilege necessary.__ Restrict a token's scope, service access, and expiration to the minimum it needs. This limits the damage if the token is ever compromised. For more information, review the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege).
* __Use different tokens for different purposes.__ Create separate tokens for different integrations and applications rather than sharing one token across many uses. When something changes or a token is compromised, you can revoke the affected one without breaking everything else.
* __Rotate tokens periodically.__ Replace long-lived tokens on a regular schedule. Even if you don't know a token has been compromised, rotation limits how long a leaked token would remain useful.
* __Monitor for unexpected activity.__ Watch the event log for token activity you don't recognize. If a token starts doing things you didn't do, revoke it immediately.
## Token scopes
You can limit the capabilities of API tokens by specifying the scope of their service-related activities. Specifically, you can allow or limit API tokens as follows:
* __Global API access (`global`)__ allows the token full control over a service with access to all API endpoints, including purging.
* __Purge full cache (`purge_all`)__ allows the token purging ability for an entire service via a [`purge_all`](/reference/api/purging/#purge-all) API request.
* __Purge select content (`purge_select`)__ allows the token purging ability via Surrogate-Key and URL but does not include the ability to purge all cache.
* __Read-only access (`global:read`)__ allows the token read-only access to account information, configuration, and stats.
## Limitations and considerations
When managing and using API tokens, keep in mind the following:
- **User-created.** Tokens can be created by any user and only apply to the user that created them. They can't be transferred to another user.
- **Per-user limit.** Each user is limited to 100 active API tokens. Deleted and expired tokens don't count against the limit.
- **Role-limited.** Tokens carry the same permissions and scopes as the user who would be performing account-based actions via the API. For example, if you've been assigned the `billing` role, your token will only allow you to perform billing-related actions.
- **Role-scoped log visibility.** The event log only shows API token activity appropriate to your user role. For example, if you've been assigned the `user` role, you can only see events from your own actions. However, if you've been assigned the `engineer` role, you can see all events related to your own actions plus all the actions on services to which you've been granted access.
- **Immutable.** API tokens can only be created, viewed, and deleted. They cannot be edited or updated.
- **Account-tied.** Tokens must be deleted (revoked) before the [account of the user who created them](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-members-and-permissions/inviting-and-removing-users) can be deleted.
- **Automatic expiration.** Unused tokens do not last forever. API tokens that remain unused for two years are automatically deleted even if they have been set to never expire.
## Legacy API credentials
If you created a Fastly account before May 15th, 2017, you may have used an API key (or multiple API keys) to authenticate API requests. This account-level credential was migrated to an API token with a `global` scope and access to all of your services. It was assigned to a newly created, synthetic user with the name `Global API Token`.
## Related content
- [Managing account-level API tokens](https://www.fastly.com/documentation/guides/organizations-and-accounts/account-members-and-permissions/managing-account-level-api-tokens)
- [User tokens API documentation](https://www.fastly.com/documentation/reference/api/auth-tokens/user/)