Bearer tokens provide enhanced security and management capabilities for REST API authentication in Axero. Available starting with Axero version 9.60, these cryptographically signed tokens replace traditional API keys and follow industry-standard protocols (RFC 7519) for secure API access.
π Administrator Prerequisites: Bearer token functionality must be enabled by an administrator through Control Panel > System > System Properties with the settings EnableLegacyAPIKey = false and EmulateLegacyAPIKey = true. See Enabling REST API Access for complete setup instructions.
EnableLegacyAPIKey = false
EmulateLegacyAPIKey = true
π User Permission Requirements: Your user role must have REST API access enabled by an administrator. If you cannot access the Authorizations section, contact your system administrator to enable API permissions for your role.
Once prerequisites are met, users can create and manage Bearer tokens through the Authorizations section in their account settings. This self-service interface provides secure token lifecycle management for API integrations with external applications and tools.
Follow these step-by-step instructions to create a new Bearer token for your API integrations:
Enter a descriptive, meaningful name that clearly identifies the token's purpose and intended use. Good naming practices help with organization and security auditing.
β Good Token Name Examples:
Automatically populated with the current date and time when the token is generated. This helps track token age and lifecycle.
Select an appropriate expiration timeframe based on your integration needs. Available options depend on your administrator's security settings:
π Critical Security Step:
β οΈ Critical Security Reminder: Bearer tokens cannot be retrieved after the initial display. The plain token value is not stored by Axero for security reasons. A cryptographic hash is retained for validation purposes. If you lose a token, you must create a new one and update all applications that use it. Plan accordingly and store tokens in a secure, accessible location.
Impersonation tokens let an administrator with impersonation permission create a token on behalf of another user. For details on how to impersonate a user, see Impersonating a User.
From the Admin area, impersonate the user.
While impersonating, open the userβs Integrations page.
Select Add Authorization to create a new token.
The new token appears in the list with a purple impersonation tag.
Impersonation tokens are only visible to administrators with the impersonation permission.
While impersonating a user, the admin can open the userβs Integrations page to view all tokens linked to that account. Impersonation tokens are marked with a purple tag and can be revoked at any time.
When the user logs in normally, they see only their own authorizations. Impersonation tokens are hidden from their view and cannot be managed from their account.
Administrators can also create impersonation tokens using the Create Bearer Token for User endpoint in the REST API.This method is useful when tokens need to be generated by integrations or automation tools.
Note: Once created, the token value is displayed only once. Copy and store it securely for future use. Each API request to create a bearer token generates a new token.
Once you've created and securely stored your Bearer token, you can use it to authenticate API requests. The token must be included in the Authorization header of every API call.
Authorization
Authorization: Bearer YOUR-BEARER-TOKEN-HERE
Replace YOUR-BEARER-TOKEN-HERE with the actual token value you copied during creation.
YOUR-BEARER-TOKEN-HERE
π cURL Example:
curl -X GET "https://yoursite.axero.com/api/users/me" \ -H "Authorization: Bearer YOUR-BEARER-TOKEN-HERE" \ -H "Content-Type: application/json"
π JavaScript (fetch) Example:
fetch('https://yoursite.axero.com/api/users/me', { method: 'GET', headers: { 'Authorization': 'Bearer YOUR-BEARER-TOKEN-HERE', 'Content-Type': 'application/json' } }) .then(response => response.json()) .then(data => console.log(data));
π Python (requests) Example:
import requests headers = { 'Authorization': 'Bearer YOUR-BEARER-TOKEN-HERE', 'Content-Type': 'application/json' } response = requests.get('https://yoursite.axero.com/api/users/me', headers=headers) data = response.json()
The Authorizations section provides comprehensive lifecycle management for all your Bearer tokens. You can monitor token status, update the organization, and maintain security through proper token hygiene.
For each token in your Authorizations list, you can view important metadata to help manage your API integrations:
π Security Note: The actual token value is never displayed after initial creation for enhanced security. Only metadata about the token is shown in the management interface. This prevents accidental exposure and ensures tokens remain secure.
Keep your token organization current by updating names to reflect changes in purpose, environment, or usage:
π‘ When to Rename Tokens:
Immediately and permanently disable a token when it's no longer needed or if security has been compromised. This is a critical security operation that should be performed carefully.
π¨ When to Revoke Tokens:
β οΈ Critical Warning: Token revocation is immediate and irreversible. Before revoking a token, ensure all applications using it are updated with a replacement token to prevent service disruptions. Consider creating and testing the new token before revoking the old one.
Following these security guidelines ensures your Bearer tokens remain secure and your API integrations are protected:
π Additional Security Recommendations:
After creating your Bearer token, follow these steps to ensure successful implementation:
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/108973/creating-bearer-tokens
Your session has expired. You are being logged out.