How do I create and revoke API tokens?

Before you begin

You need Admin access.

Read this before you start: a token cannot be edited after it is created, and its value is shown once. Getting the purpose and expiry right first time saves creating it twice.

Create a token

1. Go to Settings → Admin → API Tokens.
2. Select Create token.
3. Name it for how you will recognise it — "MCP server", "CI pipeline". The name is never sent with a request.
4. Choose the purpose.
5. Set Expires in.

Purpose decides what it can do

Two purposes, and they do not overlap:

A telemetry token is deliberately incapable of reading anything. That is the point: it goes onto every laptop in your fleet, so it must be worthless to anyone who extracts it.

Creating a telemetry token also produces ready-made config files for Claude Code, Codex and Gemini to push via MDM. See How do I set up AI usage telemetry?.

Scope

You will not be asked. A token you create is scoped to your company, and the scope selector appears only for Velory staff — the wider Organization and Unrestricted scopes are theirs, and are capped at 90 days because of it. Usage Ingest is not a choice either: it comes with the telemetry purpose.

So the Scope column in the list tells you which kind you are looking at rather than something you picked.

An API access token carries your company permissions. It is not more powerful than you are — but it is as powerful as you are, without a login.

Copy it now

On creation, the token is shown once: "This token will not be shown again. Copy it now."

There is no reveal-later. If you lose it, revoke it and create another.

For a telemetry token, the same dialog carries the config downloads. Note that Gemini has no config header — it takes an environment variable you set through your MDM instead.

Expiry

Pick a lifetime at creation. After it, requests using the token stop authenticating.

A token cannot be extended. Replacing one means creating a new token, moving your integration onto it, and revoking the old one — in that order, so nothing breaks in between.

The list shows Expires and Last used, and can be filtered by Active or Expired. Last used updates at most once a minute, so a very recent call may not show yet.

Revoke a token

Revoke stops it immediately: "Any integrations using this token will stop working immediately. This cannot be undone."

Check Last used first. A token used in the last hour is in service, whatever anyone remembers about it.

Good to know

What is the Token prefix column?

The token's first characters — enough to tell two tokens apart in the list, and to match against a log entry. The full value is only ever shown at creation.

Which permissions does an API token have?

For API access, the permissions of the person who created it, resolved at the moment of each request — not a copy taken at creation.

That has a useful consequence: narrowing the creator's role narrows every token they made, immediately and without touching the tokens.

Can I audit what a token did?

The list gives you Last used. For an audit trail of changes to roles and permissions, use the Activity Log on Roles & Permissions.

What is on the Outbound tab?

Credentials Velory uses to call external services, which are usually set up as part of connecting an integration rather than by hand here. See How do integrations work in Velory?.

Someone left the company — do I need to do anything?

Yes, revoke their tokens as part of offboarding an admin.

Removing their access does defuse the token, since it resolves their permissions on each request. But the token record survives, so restoring that person's access later re-arms every token they ever made. Revoking is the only step that actually ends it.

Can a telemetry token be used to read our data?

No, and it is blocked in two places rather than one. The purpose grants ingest only, and a usage-ingest token is refused outright on the general API path — so a token extracted from a laptop cannot be turned into an API client.