# API tokens

> The Service Account token model — anatomy and expiry.

This page covers the **Service Account API token** — the `asp_sa_…` credential your backend uses to
call the API as itself.

## Anatomy

- Tokens are opaque, high-entropy secrets with the recognizable prefix `asp_sa_`. Nothing is encoded
  in them; possession is everything.
- **The token value is returned exactly once, at creation.** Aspire stores only a hash, so a lost
  token cannot be recovered — only replaced. Treat it like a password: secret manager, never source
  control, never client-side code.
- A token belongs to a **Service Account** (your integration's identity at Aspire), which belongs to
  exactly one organization. One Service Account may hold **several live tokens at once** — that is
  deliberate, and it's what makes safe rotation possible.

Minting, rotation, and revocation are performed by Aspire; request these from your Aspire contact.
The following describes the token lifecycle model.

## Expiry

Tokens do not expire by default; scheduled rotation is the hygiene mechanism. If you want fixed-term
credentials, an expiry can be set at mint time — expired tokens fail exactly like revoked ones.