> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamoid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokens

> Create and manage Bearer tokens to authenticate API access for your workspace.

<Info>
  Tokens are workspace-scoped Bearer tokens used to authenticate Catalogix API calls. Each token is shown **only once** — copy it immediately and store it securely before leaving the page.
</Info>

## Creating a Token

<Steps>
  <Step title="Go to Tokens">
    From your active workspace, navigate to the **Tokens** section.
  </Step>

  <Step title="Create a New Token">
    Click the **Create New Token** button. Enter a name for the token and set an expiry date.
  </Step>

  <Step title="Click Create Token">
    Click **Create Token** to generate your token.
  </Step>

  <Step title="Copy Your Token">
    Copy the token immediately and store it in a secure location. It is shown **only once** — you will not be able to view it again.
  </Step>
</Steps>

<Warning>
  If you lose your token, you must revoke it and create a new one. There is no way to retrieve a token after leaving the creation page.
</Warning>

## Using Your Token

Pass the token as a Bearer token in the `Authorization` header on every API request:

```
Authorization: Bearer <your-token>
```

You can use the same token for all APIs. The Bearer token is required for all API calls except health check endpoints.

## Token Scope

* Tokens are **workspace-scoped** — a token created in one workspace cannot access another workspace.
* All API endpoints require a valid Bearer token except `GET /rate-limit-info`.

## Managing Tokens

From the **Tokens** section you can:

| Action               | Description                                                                             |
| -------------------- | --------------------------------------------------------------------------------------- |
| **View tokens**      | See all tokens in the workspace with their name, creation date, and expiry date         |
| **Revoke a token**   | Immediately invalidate a token — use this if a token is compromised or no longer needed |
| **Create new token** | Generate a new token with a name and expiry date                                        |

<Tip>
  Rotate tokens regularly and revoke any that are no longer in use. Use separate tokens for different environments (development, staging, production) to limit exposure.
</Tip>