API Tokens (Administrators)


API tokens let external tools and integrations sign in to the REST API and MCP server without storing a real person's username and password. A token is a single secret value — it starts with dmapi_ — that is generated once and used in place of a password. Anything sending the token is treated as the user the token belongs to. Tokens are the recommended credential for any automation: they can be revoked at any time without changing anyone's login, they can be set to expire, and the real password never leaves the person who owns it. Signing in to the web application is unaffected — people keep using their username, password, and any multi-factor or single sign-on exactly as before; tokens are only for API, integration, and device access.


Two kinds of token

An Integration token replaces a password in something that runs on its own: the Importer or Exporter, a Power Automate flow, a script, or an AI assistant connected through the MCP server. It is created on a screen, copied once, and pasted into that tool's configuration. A Device token is created automatically when someone signs in to the DocMgt mobile app or another device-style client. It identifies that one device, is never typed in anywhere, and stays valid while the device keeps being used. Both kinds appear in the same lists, carry the rights of the user they belong to, and are revoked the same way.


The API Tokens screen

You manage every token on the site under Admin, in the Security and Access group, on the API Tokens screen. The list shows each token's user, name, kind, who created it, its expiration, and when and from where it was last used, so you can spot tokens that are unused or about to expire. Use the kind filter to see only integrations or only devices, the filter box to search by user or name, and the Revoked toggle to include tokens that are no longer active. Device rows show the device description reported by the app when it signed in.


How a token relates to a user and its rights

Every token belongs to one DocMgt user and inherits exactly that user's rights — the same record type access, field-level rights, document rights, and search rights that apply to that user in the web application apply identically to anything using the token. A token can never do more than its user can. For integrations, the best practice is to create a dedicated DocMgt user with only the access the integration needs, leave administrator rights off, and issue the token against that locked-down account rather than a real person's login. Every action taken with a token is attributed to its user in the normal DocMgt logs.


Creating a token

Click New Token, choose the user the token will act as, give it a descriptive name so you can recognize it later (for example "Importer on server X"), and choose when it should expire. You can let it expire in 90 days, which is the recommended default, pick a specific date, or choose never to expire. When you click Generate, DocMgt shows the new token one time. For security, DocMgt stores only a one-way fingerprint of the token, never the token itself, so copy it from the confirmation dialog right away — once the dialog is closed the token cannot be retrieved again. If it is lost, revoke it and generate a new one.


Revoking tokens and signing out devices

To turn a token off, revoke it from the list. Revoking takes effect immediately and permanently: any integration still using that token stops working at once, and the action cannot be undone. For a device row the same action signs that device out, forcing it to sign in again — use it when a phone is lost or an employee leaves. Disabling a user automatically revokes all of that user's tokens and signs out all of their devices.


Settings

Click Settings on the API Tokens screen to set the site's policy. Require API tokens stops passwords from working on the REST API and MCP server: integrations must use a token, while signing in to the web application is not affected. Before the switch can be saved, DocMgt checks the last 30 days and lists every user and client that signed in to the API with a password, so you can give each one a token first — anything still using a password afterward stops working with the message "Password authentication is disabled for this site. Use an API token." User-created tokens lets users create their own Integration tokens from My Settings, with an optional cap on how long those tokens can last; users must confirm their password (and a verification code when multi-factor authentication is on) each time they create one. Signed-in devices sets how many days a device may go unused before it is signed out automatically, and the maximum number of days a device stays signed in regardless of use.


Expiry

A token stops working the moment it expires; there is no grace period. An integration whose token expired reports sign-in failures — the Importer and Exporter each log a message pointing at the expired token — until it is given a new one. Check the Expires column periodically, or before long weekends, for tokens close to their date, and rotate them by generating a new token and revoking the old one after the integration is updated.


Limits

Each user can have up to ten active Integration tokens and up to ten signed-in devices at a time. If the Integration limit is reached, revoke a token that is no longer used before generating another. When an eleventh device signs in, the device that has gone longest without use is signed out automatically so a new phone can always be enrolled.


TIPS

  1. Issue integration tokens against a dedicated, locked-down DocMgt user, not a real person's login — the token inherits exactly that user's rights and every action is attributed to it.
  2. Give every token a clear name that says where it is used, so you can recognize and revoke the right one later.
  3. Prefer a dated expiry over "never," and rotate long-lived tokens by generating a new one and revoking the old.
  4. Copy the token when it is shown — it cannot be retrieved afterward.
  5. Revoke immediately if a token may have been exposed or a device is lost; revocation is instant.
  6. Once every integration has a token, turn on Require API tokens so a leaked password can no longer reach the API.


NOTE: An API token is a password replacement for API, integration, and device access only. It grants exactly the rights of the user it is issued for, so scope that user carefully. Keep tokens secret — anyone holding a token can act as that user until the token expires or is revoked.