API tokens
This page covers the Service Account API token — the asp_sa_… credential your backend uses to
call the API as itself.
Anatomy
Section titled “Anatomy”- Tokens are opaque, high-entropy secrets with the recognizable prefix
asp_sa_. Nothing is encoded in them; possession is everything. - The token value is returned exactly once, at creation. Aspire stores only a hash, so a lost token cannot be recovered — only replaced. Treat it like a password: secret manager, never source control, never client-side code.
- A token belongs to a Service Account (your integration’s identity at Aspire), which belongs to exactly one organization. One Service Account may hold several live tokens at once — that is deliberate, and it’s what makes safe rotation possible.
Minting, rotation, and revocation are performed by Aspire; request these from your Aspire contact. The following describes the token lifecycle model.
Expiry
Section titled “Expiry”Tokens do not expire by default; scheduled rotation is the hygiene mechanism. If you want fixed-term credentials, an expiry can be set at mint time — expired tokens fail exactly like revoked ones.