Token limits
Limits and recommended practices for e6data access tokens - expiry bounds and per-consumer scoping.
Limits and recommended practices that apply to access tokens (personal access tokens and service account keys).
Expiry unit
Days
Default expiry
90 days
Maximum expiry
3650 days
Never-expires
Allowed (only with a rotation process in place)
Visibility
The secret is shown once at creation
Keys per service account
No hard limit (rotate freely)
Recommended practices
One credential per consumer - never share a token across apps or teams, so you can revoke one without breaking others.
Set an expiry and rotate before it lapses, using create-before-delete.
Least privilege - a token is exactly as powerful as the role bound to its owner; grant the minimum needed.
For the full guidance, see Token security best practices.
See also
Last updated
Was this helpful?