My access tokens

Found at your account menu → My access tokens.

A personal access token lets a tool — an AI assistant such as Claude, a script, a BI tool — act as you, with only the permissions you choose. It belongs to you, not to an affiliate, so publishers, account managers and admins all have this page.

It is separate from the API tokens page. Those tokens belong to an affiliate and always act as that affiliate's publisher; an account manager or admin has no affiliate to create one under. Use this page when the tool should act as you.

What a token can and can't do

• Never more than you. A token can only use permissions you hold yourself. If your own access is reduced, every token you made shrinks with it.
• Only what you ticked. A token carries exactly the permissions you chose when you created or last edited it. It never gains a permission on its own — not even one you're given later.
• One affiliate at a time. A token works on the affiliates you chose (or all of yours). A tool picks which one on each request.
• Unused tokens switch themselves off after 90 days without use (7 days for a token with System admin). A switched-off token cannot be turned back on — create a new one.

Create a token

1. Click New token.
2. Give it a name — at least 4 characters, unique among your tokens. Name it after the tool and the job ("Claude — reporting"); that's how you'll recognise it later.
3. Pick when it expires: a date, or No expiration. A token with no expiration still switches itself off after 90 days unused.
4. Choose the affiliates it works on. Leave the box empty and it works on all your affiliates, including ones you get access to later. Pick some and it is limited to those.
5. Tick the permissions it needs. They're grouped (Accounts, Reports, …); Select all ticks every permission in the list — never the admin ones below it. Pick the fewest that do the job.
6. Click Create.
7. Copy the token now. Use Copy or Download .txt.

The token is shown once. After you close that panel it can't be shown again — not by us, not by support. If you lose it, revoke the token and create a new one.

You can have up to 20 active tokens at a time. Expired, switched-off and revoked tokens don't count.

Admin permissions

If you hold them, System admin and Account manager appear in their own section below the checklist. They grant full administrative access, including every admin screen — use them only for tools you fully trust. Select all never ticks them.

A token with System admin:

• must have an expiry date, at most 30 days ahead — No expiration isn't offered;
• works on every affiliate, so it can't be limited to selected affiliates (the affiliate box is disabled while System admin is ticked, and System admin is unavailable while affiliates are selected);
• switches itself off after 7 days unused.

The list

"N new permissions available"

This appears on a token when you hold permissions the token doesn't carry — usually because new permissions were added to the platform, or you were given more access. Tokens never pick these up automatically; that's deliberate. Click the badge to open the token with the new permissions marked New, tick the ones you want, and save.

Edit a token

Click Edit on an active token. You can change its name and its permissions:

• Removing a permission: untick and save.
• Adding a permission: tick and save. Only permissions you hold are offered.

The secret doesn't change, so the tool keeps working without being reconfigured.

The expiry and the affiliates can't be changed — to change them, create a new token. For the same reason, System admin can't be added to a token that is limited to some affiliates, or that has no expiry or one more than 30 days away.

Expired, switched-off and revoked tokens can't be edited.

Revoke a token

Click the revoke icon on the row (or Revoke on the card on a phone) and confirm. The token stops working within 30 seconds — tokens that were just checked are briefly remembered. If you're revoking because a token leaked, treat that half-minute as real.

Revoked tokens stay in the list, greyed, so you can see what happened to them. You can reuse a revoked token's name.

Using a token (for whoever sets up the tool)

Send it as a header on every request:

Authorization: Bearer rpat_…

Authorization: ApiKey rpat_… works too.

A token that works on more than one affiliate must say which one each request is for, with the x-affiliate-id header. Leave it out and the request is refused with a 400 whose info.affiliateIds lists the affiliates the token can use — a quick way for a tool to discover them.

A token can't create, edit or revoke tokens. That needs you, signed in.

Common questions

The page says access tokens aren't available yet. The feature hasn't been switched on for your account. Nothing is wrong with your access.

A tool that worked yesterday now gets 401. Check the token's Status. Expired and Disabled — unused tokens can't be revived — create a new one and give the tool the new secret.

A tool gets 403 on something it used to do. The token doesn't carry that permission, or you no longer hold it yourself. Edit the token to add it, if it's offered; if it isn't offered, you don't hold it.

I can't tick System admin. Either the token is limited to selected affiliates, or (when editing) its expiry is missing or more than 30 days away. Create a new token instead.