Access tokens
A personal access token lets a script, a dashboard or an assistant talk to Flotera without your password and without your session.
Rights are an intersection, checked every time
Section titled “Rights are an intersection, checked every time”Your effective permissions are:
your role ∩ the token's scopes ∩ your planAll three, on every request. A token cannot exceed your own rights, and neither can exceed what your plan includes.
What each plan allows
Section titled “What each plan allows”| Plan | API tokens |
|---|---|
| Free, Standard | none |
| Professional · Optimize | read |
| Professional · Automate | full |
Read access covers the fleet, the market, earnings and history. Full access adds the operations that change something.
Scopes
Section titled “Scopes”Scopes are narrow on purpose. A monitoring dashboard needs to read servers and telemetry; it does not need to reboot anything, and giving it that right because it was convenient is how an accident happens at 3 a.m.
Give a token the smallest set that makes it work, and issue a second token rather than widening the first.
Handling the token itself
Section titled “Handling the token itself”The token is shown once, when you create it. Flotera stores a hash, not the value — there is no way to recover it later, only to revoke and issue another.
Treat it like a password:
- Keep it in a secret store or an environment variable, never in a repository.
- One token per consumer, so revoking one does not break the others.
- Revoke immediately if it may have leaked. Revoking is exempt from plan gating — you can always revoke, whatever your plan.