🎟️ API Token
A token for an API: how it's sent (Bearer, OAuth or a custom header), the token itself and the API's URL.
- The token is a fixed value: it can be revealed and copied, never generated or rotated.
- For an agent, prefer
sneakers-run, which hands the token to one command without it passing through the agent's transcript.
Type id: type-api-token. Agents and sneakers-put name the type by this id; sneakers_list_secret_types lists it.
🧾 Fields
| Field | Key | Kind | Required | Secret | Notes |
|---|---|---|---|---|---|
| Description | description | Multi-line text | No | No | |
| Scheme | scheme | Choice | No | No | One of Bearer, OAuth, Custom header; default Bearer |
| Token | token | Secret value (never generated) | Yes | Sensitive | |
| Endpoint / API URL | endpoint | Text | No | No | |
| Notes | notes | Multi-line text | No | No |
🔒 What's secret
Token is masked until someone who can read the secret reveals or copies it, and every reveal and copy is written to the audit trail. Everything else is plain metadata that anyone who can see the folder can see.
🔁 Heartbeat, rotation and check-out
- Heartbeat: no.
- Rotation: no.
- Check-out: no.
🎯 Targets
An API Token takes no target.