---
title: Automation Tokens
summary: Automation tokens differ from other token types because they are not tied to a specific person and therefore are not subject to the lifecycle of such accounts. Automation tokens are sometimes also called "service accounts". They are designed for API automation use-cases such as continuous integration, deployment pipelines, or automation scripts. For more information about authentication tokens, review the <a href="https://www.fastly.com/documentation/reference/api/auth-tokens/user/">Authentication token</a> documentation.
url: https://www.fastly.com/documentation/reference/api/auth-tokens/automation
---

Automation tokens differ from other token types because they are not tied to a specific person and therefore are not subject to the lifecycle of such accounts. Automation tokens are sometimes also called "service accounts". They are designed for API automation use-cases such as continuous integration, deployment pipelines, or automation scripts. For more information about authentication tokens, review the <a href="https://www.fastly.com/documentation/reference/api/auth-tokens/user/">Authentication token</a> documentation.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `expires_at` | string | A UTC timestamp of when the token expires. |
| `limit_services` | boolean | When <code>true</code>, the token is restricted to only the services in the <code>services</code> array. When <code>false</code>, the token has access to all services. |
| `limit_workspaces` | boolean | When <code>true</code>, the token is restricted to only the workspaces in the <code>workspaces</code> array. When <code>false</code>, the token has access to all workspaces. Only applies to roles that support workspace access. |
| `name` | string | The name of the token. |
| `role` | string | The primary role on the token. For tokens with multiple roles, this returns the highest-priority role for backwards compatibility. |
| `roles` | array | All roles assigned to the token. Each role includes an <code>id</code> and <code>name</code>. |
| `scope` | string | A space-delimited list of authorization scope. |
| `services` | array | The service IDs of the services the token has access to. Empty when <code>limit_services</code> is <code>false</code> (full access) or when the token has no service access. |
| `workspaces` | array | The workspace IDs of the workspaces the token has access to. Returns an empty array for tokens without workspace access. |
| `tls_access` | boolean | Indicates whether TLS access is enabled for the token. Only applicable when using the single-role <code>role</code> field. For tokens with multiple roles, assign TLS roles (<code>tls_admin</code> or <code>tls_viewer</code>) via the <code>roles</code> field instead. |
| `created_at` | string | A UTC timestamp of when the token was created. (Read-only) |
| `customer_id` | string | Alphanumeric string identifying the customer. (Read-only) |
| `id` | string | Alphanumeric string identifying a token. (Read-only) |
| `last_used_at` | string | A UTC timestamp of when the token was last used. (Read-only) |
| `user_agent` | string | The User-Agent header of the client that last used the token. |
| `user_id` | string | Alphanumeric string identifying the user. (Read-only) |
| `errors` | array |  |
| `ip` | string | The IP address of the client that last used the token. |
| `limit` | integer | Number of results requested. |
| `next_cursor` | string | Cursor for the next page. Empty string when there are no more results. |
| `previous_cursor` | string | Cursor for the previous page. Empty string when on the first page. |
| `meta` | object |  |

## API endpoints

### List Customer Automation Tokens

**GET** `/automation-tokens`

Lists all automation tokens for a customer.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `page` | integer | query | No |  |
| `per_page` | integer | query | No |  |

### Create Automation Token

**POST** `/automation-tokens`

Creates a new automation token.

### Retrieve an Automation Token by ID

**GET** `/automation-tokens/{id}`

Retrieves an automation token by ID.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes |  |

### Revoke an Automation Token by ID

**DELETE** `/automation-tokens/{id}`

Revoke an automation token by ID.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes |  |

### List Automation Token Services

**GET** `/automation-tokens/{id}/services`

List of services associated with the automation token.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes |  |
| `page` | integer | query | No |  |
| `per_page` | integer | query | No |  |

### List Automation Token Workspaces

**GET** `/automation-tokens/{id}/workspaces`

Lists the Next-Gen WAF workspaces accessible by an automation token. Only applicable for tokens with roles that support workspace access (such as Next-Gen WAF roles).

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Pagination cursor from a previous response. Pass the <code>next_cursor</code> value to retrieve the next page, or <code>previous_cursor</code> to go back. |
| `id` | string | path | Yes | The alphanumeric string identifying the automation token. |
| `limit` | integer | query | No | Maximum number of workspaces to return per page. |