API tokens
Integrations (a whitelist app, a Discord bot, a script) use API tokens instead of an account.
Create a token
Section titled “Create a token”API tokens in the tenant menu. The token is shown once; the panel keeps only a hash.
Authorization: Bearer sp_1a2b3c4d_<secret>| Kind | Acts as | Who creates it |
|---|---|---|
| Service token | the tenant, for an integration | owners and admins |
| Personal token | its user; never more than that user may do | anyone, for themselves |
Limits
Section titled “Limits”A token is limited to:
| Limit | Example for a DayZ whitelist app |
|---|---|
| tenant | its own tenant only; any other answers 404 |
| servers | the DayZ server |
| permissions | server.view, files.read, files.write, console.write, power.start, power.stop, power.restart |
| file paths | whitelist.txt, serverDZ.cfg |
| networks | 10.11.0.0/24 (where the app runs) |
| expiry | optional |
Give a token only what its integration needs. The panel records when each token was last used.
Tokens can only call the server API. Account, tenant and node endpoints refuse them with 403 token_not_allowed.
Permissions: Permissions. Endpoints: Game host API.