Token Management
Manage access tokens, refresh tokens, and session lifecycle. Sound token hygiene is one of the most effective ways to keep a governed workspace secure.
Token Lifecycle
A token moves through issuance, active use, expiry and, optionally, revocation. Access tokens carry a short expiry window by design, which limits how long a leaked token remains useful, while refresh tokens live longer and are used only to obtain new access tokens. Every token is bound to a workspace and to the identity that authorized it, and both the workspace and the identity can independently end the token's life.
Revoking Tokens
Tokens can be revoked from the workspace's connected-apps settings, either individually or by revoking the entire application's grant. Revocation takes effect immediately and any subsequent request using that token receives an authentication error rather than being allowed to complete. Revoke tokens promptly when an integration is decommissioned or when a team member who authorized a connection leaves the workspace.
Best Practices
Store tokens in a secrets manager rather than in source control or application logs, and scope each integration to its own credential so that revoking one does not disrupt others. Refresh access tokens proactively before they expire instead of waiting for a request to fail, and monitor for repeated authentication errors, which often indicate a stale or revoked credential still in use somewhere in your systems.