> ## Documentation Index
> Fetch the complete documentation index at: https://social-b97141fb-feat-user-history-moderation-detail.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Tokens

> Generate, rotate, and revoke console admin tokens with strong operational governance.

<Info>
  Operational guide to generate, rotate, and revoke admin tokens while minimizing exposure risk.
</Info>

<CardGroup cols={3}>
  <Card title="Generate" icon="key">Create new token (1 year)</Card>
  <Card title="Rotate" icon="arrows-repeat">Invalidate & replace</Card>
  <Card title="Revoke" icon="shield">Immediate invalidation</Card>
  <Card title="Audit" icon="clock">Track usage & age</Card>
  <Card title="Least Privilege" icon="lock">Limit who can issue</Card>
  <Card title="Compliance" icon="check">Meet rotation policies</Card>
</CardGroup>

## Token Basics

| Aspect | Value |
| - | - |
| Default Expiry | 1 year (newly generated) |
| Visibility | Shown once at creation dialog |
| Scope | Console administrative API operations |
| Not Available For | Super Admin accounts |

<Warning>Copy token immediately; it cannot be retrieved later—only regenerated.</Warning>

## Generate Token

<Steps>
  <Step title="Navigate">Settings → Admin Users.</Step>
  <Step title="Options">Click ellipses … next to your admin user.</Step>
  <Step title="Generate">Select Generate new token.</Step>
  <Step title="Copy">Securely store in secrets manager.</Step>
  <Step title="Distribute">Limit distribution to required automation only.</Step>
</Steps>

## Rotation Strategy

<AccordionGroup>
  <Accordion title="Planned Rotation">Generate replacement token → update dependent services → revoke old (grace window ≤24h).</Accordion>
  <Accordion title="Unplanned Rotation">Suspected leak → immediate revoke → generate new → notify stakeholders.</Accordion>
  <Accordion title="Inventory Tracking">Maintain registry: owner, creation date, last used timestamp.</Accordion>
  <Accordion title="Automation Use">Prefer service-specific tokens rather than sharing a personal admin's token.</Accordion>
</AccordionGroup>

## Revoke Token

<Tabs>
  <Tab title="Self-Revoke">Admin revokes own token via same menu; session invalidated, re-login required.</Tab>
  <Tab title="Super Admin Revoke">Super Admin can revoke another admin's token if misuse or offboarding.</Tab>
  <Tab title="Post-Revoke">Old token immediately fails; dependent scripts must update to new token.</Tab>
</Tabs>

<Info>Errors when revoking: non-admin attempts or unknown username.</Info>

## Metrics

| Metric | Description | Threshold |
| - | - | - |
| Active Tokens | Count of valid admin tokens | Unexpected growth → audit issuance |
| Avg Token Age (days) | Mean age since creation | > 300 → schedule rotations |
| Orphan Tokens | Tokens with no recent usage (≥30d) | >0 → revoke |
| Compromise Incidents | Confirmed leaks | Any >0 → tighten issuance policy |

## Troubleshooting

| Issue | Likely Cause | Fix |
| - | - | - |
| Cannot generate | Super Admin account | Use general admin account |
| Token lost | Not stored at creation | Generate new token; revoke old if still active |
| Script failing after rotation | Not updated credential | Update secret store & redeploy |
| Revocation error | Username mismatch | Verify exact admin username |

## Related

<CardGroup cols={2}>
  <Card title="Security" icon="lock" href="./security">Secure Mode & mTLS</Card>
  <Card title="Admin Access" icon="users" href="/analytics-and-moderation/console/management/admin-access-control">Permission governance</Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.