API tokens

Creating a token

API tokens (prefixed ppk_) let you drive Proxploy from scripts or other tools without using your own session. Tokens are created and managed from your profile page; the API is also available at /api/v1/api-keys for automation.

A token can optionally be scoped to specific permissions (read-only, or write access to one resource type), and can optionally be given an expiry. Tokens are hashed at rest; if you lose the value after creation, there’s no way to retrieve it again, only to issue a new one.

What a token can and can’t do

A token’s scopes are checked ahead of your normal role, which means a token can only ever narrow what its owner is allowed to do, never extend it. A read-only token can’t be used to trigger a job even if the account that created it is an admin, and a token can’t grant access to anything the account itself doesn’t already have. If your account’s role changes or is revoked, every token you’ve created is bound by that same limit going forward.