API tokens and scoped access

Create the smallest scope

1. 1Open Admin, then API Keys.
2. 2Name the integration or system owner.
3. 3Choose only the scopes the integration needs.
4. 4Create the token and copy it into the approved secret manager immediately.
5. 5Test the intended endpoint without exposing the token in logs.

Copy-once secret

QuoteDeck displays a newly created secret for secure capture. Treat it like a password and do not expect to retrieve the full value later.

Rotation and revocation

Revoke a token when its owner, destination, or purpose changes. Create the replacement first when continuity is required, validate it, then revoke the old credential.