Guides

API tokens

Create Cloud Control API tokens (cc_pat_…) for automation: a role ceiling that can't exceed yours, an expiry, a one-time secret, last-used tracking and revocation.

API tokens let scripts and CI authenticate to the Cloud Control API without a browser session. A token authenticates as a user within your organization and carries a role as its capability ceiling.

Creating an API token and its one-time cc_pat secret on the Team page

Create a token

`POST /api/org/tokens` takes a name, a role (from the assignable org roles) and an optional expiresDays. Any member may create tokens whose role's capabilities are a subset of their own — a Viewer cannot mint an Org Admin token. The secret, prefixed cc_pat_, is returned exactly once in the create response; only its SHA-256 is stored, so no read path ever returns it again.

Field	Rule
`name`	Required, 1–60 characters.
`role`	One of Viewer, Deployer, SRE · Cloud Admin, Org Admin — and never above your own capabilities.
`expiresDays`	Optional. Defaults to 30 days; up to 365; `null` for no expiry.

Use a token

Send it as a Bearer header on any API route: Authorization: Bearer cc_pat_…. The token's role is the ceiling for that request, and it never confers owner or platform powers regardless of who created it.

bash

curl -s https://cloud-control.snoweasl.com/api/cloud/resources \
  -H "Authorization: Bearer cc_pat_YOUR_TOKEN_HERE"

Lifecycle

Visibility — members see their own tokens; org admins see the whole organization's, via `GET /api/org/tokens`.
Last used — the token's lastUsedAt updates as it is used (throttled to at most once a minute).
Expiry / revocation — an expired or revoked token returns the same 401 as an unknown one — no signal about why.
Revoke — `DELETE /api/org/tokens/{id}` revokes a token. Deleting a user also revokes their tokens.

Tokens can't manage tokens

Token-administration endpoints require a signed-in session; a request authenticated with a Bearer token gets a 403. This keeps a leaked token from minting more tokens.