API Access

API Access lets admins create and manage API tokens for trusted external tools. Use it when a connected tool needs controlled access to Edmissa data or actions.

Treat API tokens like passwords. A token can allow another system to act inside the workspace based on the access granted to it.

What this guide helps you configure

Area	What it helps with
Token creation	Generate a token for a trusted integration or internal tool.
Token naming	Make each token easy to identify later.
Access review	Confirm who owns the token and why it exists.
Rotation and removal	Replace or revoke tokens when access should change.

Before you start

Prepare these decisions before generating a token:

Item	Why it matters
Integration owner	One person should own the token and know why it exists.
Use case	The token should have a clear job, such as a website form, reporting tool, or approved integration.
Access need	Give only the access needed for that job.
Storage plan	Decide where the token will be stored securely after it is generated.
Review date	Tokens should be reviewed on a schedule.

Do not generate tokens for casual testing unless you know how they will be removed after the test.

Open API Access

Use this path when you want to manage API tokens:

Open Settings.
Open API Access.
Confirm the page title is API Access.

The direct route is /t/settings/api-access.

Use Generate Token when a trusted external tool needs a new token.

Generate a token

Use this flow when a new token is needed:

Open API Access.
Select Generate Token.
Add a clear name for the token.
Choose the access settings shown in your workspace.
Generate the token.
Store the token in the approved secure location.
Record who owns it and what it is used for.

Only share the token with the person or system that needs it. If a token is copied into an unsafe place, revoke it and create a new one.

Naming guidance

Use token names that explain the owner and purpose.

Better name	Why it works
Website Lead Form	Shows the token belongs to the website intake flow.
Reporting Export Tool	Shows the token belongs to reporting work.
Approved Partner Integration	Shows the token belongs to a partner connection.

Avoid names such as test, new token, or a person's first name only. Those names become difficult to review later.

Safe API Access practices

Practice	Why it matters
Use one token per system	If one system changes, you can revoke only that token.
Keep access narrow	A token should only do the work it needs to do.
Store tokens securely	Tokens should not be kept in chat messages, spreadsheets, or plain notes.
Review tokens regularly	Old tokens can keep access open after a project ends.
Revoke unused tokens	Remove access when a tool, partner, or test is no longer active.

If you are not sure whether an external tool needs API access, pause and review the integration plan first.

Test after setup

After generating a token:

Confirm the token name is clear.
Confirm the token owner is documented.
Test the connected tool with sample work.
Confirm the tool can do only the intended job.
Review audit logs or activity history when available.
Revoke the token if the test is no longer needed.

Guide	Use it for
Security and audit	Review how API access fits with account protection and audit review.
Integrations	Connect external tools and Lead channels.
Lead Sources	Track which channels create Leads.
Audit Logs	Review activity after sensitive changes or connected-tool activity.
Permissions and scope	Understand access levels and system setting access.

On this page