LaunchDarkly Developer Documentation

Get started in under 30 minutes.
LaunchDarkly provides feature flags as a service for Java · Python · Ruby · Go · Node.js · PHP · .NET. Control feature launches -- who sees what and when -- without multiple code deploys. Easy dashboard for phased rollouts, targeting and segmenting.
Need more help? write us at support@launchdarkly.com

Get Started    Documentation

Personal API access tokens

Overview

This topic explains how to use personal API access tokens to authenticate with the LaunchDarkly REST API, as well as constraints and suggestions for implementing them.

Personal API access tokens are private

Only you can see the tokens you create; other team members cannot see them.

Administrators can delete your tokens, but cannot see their values.

Scoping personal API access tokens

You can scope your personal API tokens to restrict the set of operations they can perform. For example, you can build an integration that only has read access to the REST API.

The available scoping options are:

  • Built-in roles: Gives a token the same permissions as a Reader, Writer, or Admin.
  • Custom roles: Gives a token the same permissions as one of your team's existing custom roles. This option is only available if your LaunchDarkly plan includes custom roles.
  • In-line custom roles: Gives a token a custom set of permissions in-line, rather than specifying it as an existing custom role. This option is only available if your LaunchDarkly plan includes custom roles.

Understanding personal API access tokens' permissions

When you create a new token, it has the same permissions that you do. Your tokens can never do more than you can in LaunchDarkly.

Personal API access tokens and the principle of least privilege

As a best practice, we recommend giving your tokens the smallest scope required for your integration.

For example, if your integration is not designed to modify your Production environment, use a custom role or inline policy to restrict access appropriately.

If your own permissions are ever reduced, tokens you have created have reduced scope as well.

For example, if you are a Writer and create a Writer token, but then are downgraded to a Reader, your Writer token will behave like a Reader token.

Creating personal API access tokens

You can create a personal API access token from the Account settings page.

To create a personal access token:

  1. Navigate to the Account settings page.
  2. Click into the Access tokens tab.
  3. Click New token. The Create an access token screen appears.
The Create an access token screen.

The Create an access token screen.

  1. Give your token a human-readable Name.
  2. Assign a Role to the token by choosing one from the dropdown.
  3. Click Save Token. The new token appears in the Access tokens page.

You can also manage existing tokens from the Authorizations tab. From that tab, you can change the scope of your tokens or delete them.

If you delete a token, API calls made with that token will return 401 Unauthorized status codes.

Removing team members

If you remove a team member from your account, their personal API access tokens become invalid. We recommend updating integrations to use new access tokens before removing team members.

Restricting who can create and manage personal API access tokens

By default, all team members can create access tokens limited to their existing permissions. Team members with reader level permissions can only create tokens with reader permissions, whereas admins and owners can create tokens with any permission level.

You can restrict team members from creating or managing access tokens with custom roles.

To learn more, read Actions in custom roles.


Personal API access tokens


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.