Moving Importer and Exporter to API Tokens — Step by Step

This guide walks through switching an Importer or Exporter installation from a username and password to an API token, and then (optionally) locking passwords out of the API entirely. Nothing here interrupts the running Importer or Exporter until the final save of each folder's configuration, and each step can be verified before moving to the next.


Before you start

You will need administrator access to the DocMgt site and access to the machine where the Importer or Exporter runs. Decide which DocMgt user each integration should act as. If your Importer and Exporter currently sign in as a real person, this is the moment to fix that: create a dedicated user (for example "svc-importer") with only the record types and rights the integration needs and no administrator role, because the token will carry exactly that user's rights and every imported document will be attributed to it.


Step 1 — Create a token for the Importer

In DocMgt, go to Admin, open the Security and Access group, and click API Tokens. Click New Token. Choose the Importer's user, name the token so you can recognize it later — include the machine, for example "Importer on FILESERVER01" — and keep the recommended 90-day expiry unless you have a reason not to. Click Generate.


Step 2 — Copy the token

The token (a long value starting with dmapi_) is shown exactly once. Click Copy and paste it somewhere transient like a text editor — you will paste it into the Importer in the next step, and then it should exist nowhere else. If you close the dialog without copying, just revoke that token and generate another; nothing has used it yet.


Step 3 — Put the token in the Importer

On the Importer machine, open the Importer configuration for the folder and go to the General tab. In the Connection section, paste the token into the API Token field. The Username and Password fields gray out — with a token present they are ignored, and you can clear them if you like. Click Test Login. You should see "Login Successful"; if you see an error instead, the token was pasted incompletely or was created for a user that is inactive.


Step 4 — Save and verify a real run

Save the configuration and let the Importer process the folder (or drop a test file in). Confirm in DocMgt that the documents arrive and are attributed to the token's user. The Importer is now running without a password.


Step 5 — Repeat for the Exporter

The Exporter is configured the same way: create a second token (its own token, its own name — for example "Exporter on FILESERVER01" — even if it uses the same service user), open the Exporter configuration's General tab, paste it into API Token, click Test Login, save, and verify an export runs. Giving each installation its own token means you can later revoke one without touching the other.


Step 6 — Repeat for anything else using a password

Any other integration that signs in to the REST API or MCP server with a username and password — Power Automate flows, scripts, AI assistants — gets the same treatment: create a token, replace the password with it, verify. You can see what is still using a password in the next step's check.


Step 7 (optional) — Require API tokens

Once every integration has a token, go back to Admin → Security and Access → API Tokens and click Settings. Turn on Require API tokens. DocMgt immediately shows every user and client that signed in to the API with a password in the last 30 days — if the list is empty, you are ready; if anything is listed, give it a token first (steps 1–3) and check again. Save the settings. From this moment passwords are refused on the REST API and MCP server with the message "Password authentication is disabled for this site. Use an API token.", while everyone continues to sign in to the web application exactly as before.


When a token expires

Tokens created with the default expiry stop working after 90 days, and the Importer or Exporter will log a message saying the token was rejected and where to get a new one. To renew without a gap: create the new token a few days early, paste it into the folder's configuration, Test Login, save, and then revoke the old token. The Expires column on the API Tokens screen shows every token's date.


TIPS

  1. One token per installation — separate tokens for the Importer and Exporter, and per machine, so revoking one never breaks another.
  2. Put the machine name in the token name; a year from now "Importer on FILESERVER01" is findable, "importer2" is not.
  3. Use Test Login after every paste — it catches a truncated token in seconds.
  4. Renew expiring tokens before they lapse: new token in, test, save, then revoke the old one.
  5. Do step 7 — leaving passwords enabled on the API keeps the door open that tokens were meant to close.


NOTE: The token is shown once at creation and is stored encrypted in the Importer/Exporter configuration. If a token is ever exposed, revoke it on the API Tokens screen and issue a new one — revocation is immediate.