Overview
Members create API tokens to connect scripts and integrations to Shortcut. Each member manages their own tokens in Settings > Account > API Tokens, and can’t see anyone else’s.
The Workspace API Tokens page lets an Admin see every API token in the workspace, no matter who created it. Use it to find tokens that nothing uses anymore, and to disable a token that may have leaked or that you don’t recognize.
The page never shows a token’s value.
Who can use it
You need the Admin role in the workspace. Members and Observers don’t see the page in Settings. See User Roles.
Open the page
- Open Settings.
- Select Workspace API Tokens.
The page lists the active tokens in the current workspace. If your organization has several workspaces, open the page in each one.
What each column means
| Column | Description |
|---|---|
| Description | The name the owner gave the token when they created it. |
| Owner | The member who created the token. |
| Status | Whether the token works. See Token status. |
| Type | v4 is the current token format. Legacy is an older format. |
| Access level | What the token can do, for example Read-only or Read + Write. |
| Created | The date the token was created. |
| Expires | The date the token stops working, or Never. |
| Last used (UTC) | The most recent day, in UTC, that the token made a request. Never means it hasn’t been used. |
Select a column header to sort by that column. Select it again to reverse the order. By default, the newest tokens are first.
Token status
| Status | Meaning |
|---|---|
| Active | The token works. |
| Disabled | The owner deleted the token, or an Admin disabled it. It doesn’t work. |
| Disabled (owner removed) | The owner no longer has access to the workspace, so the token doesn’t work. If you add that person back to the workspace, the token works again. |
| Expired | The token passed its expiry date. It doesn’t work. |
The page shows only active tokens by default. To see the others, check Show disabled tokens. Tokens that don’t work appear faded.
Disable a token
Disabling a token stops it from working immediately. Any script or integration that uses it stops working too. You can’t turn a disabled token back on. The owner must create a new token.
- Find the token. Check Last used (UTC) to see whether something still uses it.
- Select Disable in the token’s row.
- Select Disable token to confirm.
The token’s status changes to Disabled, and it leaves the default list.
Only active tokens have a Disable button.
Before you disable a token that is still in use, ask its owner what depends on it. That way they can replace it before their integration breaks.