# Workspace API Tokens

See every API token in your workspace, check when each one was last used, and disable tokens you don't trust.

## Overview

Members create API tokens to connect scripts and integrations to Shortcut. Each member manages their own tokens in **Settings > Account > API Tokens**, and can't see anyone else's.

The **Workspace API Tokens** page lets an Admin see every API token in the workspace, no matter who created it. Use it to find tokens that nothing uses anymore, and to disable a token that may have leaked or that you don't recognize.

The page never shows a token's value.

## Who can use it

You need the Admin role in the workspace. Members and Observers don't see the page in Settings. See [User Roles](/help/admin/user-roles).

## Open the page

1. Open **Settings**.
2. Select **Workspace API Tokens**.

The page lists the active tokens in the current workspace. If your organization has several workspaces, open the page in each one.

## What each column means

| Column | Description |
|--------|-------------|
| **Description** | The name the owner gave the token when they created it. |
| **Owner** | The member who created the token. |
| **Status** | Whether the token works. See [Token status](#token-status). |
| **Type** | **v4** is the current token format. **Legacy** is an older format. |
| **Access level** | What the token can do, for example **Read-only** or **Read + Write**. |
| **Created** | The date the token was created. |
| **Expires** | The date the token stops working, or **Never**. |
| **Last used (UTC)** | The most recent day, in UTC, that the token made a request. **Never** means it hasn't been used. |

Select a column header to sort by that column. Select it again to reverse the order. By default, the newest tokens are first.

## Token status

| Status | Meaning |
|--------|---------|
| **Active** | The token works. |
| **Disabled** | The owner deleted the token, or an Admin disabled it. It doesn't work. |
| **Disabled (owner removed)** | The owner no longer has access to the workspace, so the token doesn't work. If you add that person back to the workspace, the token works again. |
| **Expired** | The token passed its expiry date. It doesn't work. |

The page shows only active tokens by default. To see the others, check **Show disabled tokens**. Tokens that don't work appear faded.

## Disable a token

Disabling a token stops it from working immediately. Any script or integration that uses it stops working too. You can't turn a disabled token back on. The owner must create a new token.

1. Find the token. Check **Last used (UTC)** to see whether something still uses it.
2. Select **Disable** in the token's row.
3. Select **Disable token** to confirm.

The token's status changes to **Disabled**, and it leaves the default list.

Only active tokens have a **Disable** button.

> Before you disable a token that is still in use, ask its owner what depends on it. That way they can replace it before their integration breaks.