API tokens and sessions

Use API tokens for supported integrations and automation that should not sign in with a person's password.

Choose only the scopes the integration needs. Tokens do not provide identity-administration capabilities.

Treat a token like a password: copy it to its destination when created, store it in a secret manager and revoke it when it is no longer needed or may have been exposed.

Revoke and delete tokens

Revoke stops an active token or paired migration credential from being used. Once a token is inactive, Delete removes its retained token record from the Access list. Identity Audit keeps the security history even after the inactive record is deleted.

Active browser sessions

Open Security → Access to review active Control browser sessions. Each session shows the panel account, source IP, browser/client, sign-in time, last activity and expiry.

Administrators can review and revoke sessions across panel users. Operators and read-only users see only their own sessions. The browser you are currently using is marked Current; end that session with Sign Out rather than the revoke action.

Revoking another session invalidates it immediately. API tokens cannot list or revoke browser sessions.

Control-to-Control one-time pairing

On the source Control server, open Access → API Tokens and create a Migration token. It is shown only once and can enroll one destination Control. On the destination, open Server → Migration → Add Source, enter the source Control address and paste the token.

The one-time token is consumed when pairing succeeds. Later inventory and Site transfers use the established destination-specific pairing rather than reusing the original token. Short token expiry limits enrollment, not the lifetime of an established pairing.

To immediately stop a paired destination, choose Revoke on the source token record. When the inactive record is no longer needed in the Access list, choose Delete. Removing a migration source normally also attempts source-side revocation.