Service Token
| Name (singular): | Service Token |
| Name (plural): | Service Tokens |
| Alias (uri): | service_token |
| Identifier (ID): | cerb.contexts.service.token |
Usage tracking
Service Token worklists offer a 'Usage' sparklines column charting authentications, with a 2h/1d/30d range toggle. A matching usage: quick search filter queries the same data – for instance, usage:(since:today).
A service token authenticates anonymous, privileged access to endpoints like /cron, /debug, and /update. Service tokens replace the AUTHORIZED_IPS_DEFAULTS IP allowlist – and the now-removed DEVELOPMENT_MODE_ALLOW_DEBUG flag – with a more flexible, auditable mechanism that works regardless of where requests originate.
Tokens are passed either in an HTTP Authorization: Bearer <token> header or as an _authorization POST parameter – for instance, from a cronjob, monitoring tool, or deploy script. Each token can be restricted to specific endpoint scopes (e.g. cron:*, debug:*, update). When viewing a protected endpoint in the browser, a token can be entered through a login prompt to continue.
A master service token may be configured in framework.config.php using APP_SERVICE_TOKEN – particularly useful for /update, since worker logins are blocked until the update finishes. The master token's scope defaults to * (all endpoints) but may be restricted with APP_SERVICE_TOKEN_SCOPE.
Service tokens are managed from Setup » Configure » Security.
Records API
These fields are available in the Records API and packages:
| Req'd | Field | Type | Notes |
|---|---|---|---|
created_at |
timestamp | The date/time when this record was created | |
expires_at |
timestamp | Optional expiration date; 0 for no expiration |
|
id |
number | The ID of this service token | |
last_accessed_at |
timestamp | The date/time when this token was last used | |
links |
links | An array of record type:id tuples to link to. Prefix with - to unlink. |
|
| x | name |
text | A human-readable label for this token |
scopes |
text | A space-separated list of endpoint scopes (e.g. cron:* debug:status) |
|
updated_at |
timestamp | The date/time when this record was last modified |
Dictionary Placeholders
These placeholders are available in dictionaries for automations, snippets, and API responses:
| Field | Type | Description |
|---|---|---|
_context |
text | Record type extension ID |
_label |
text | Label |
_type |
text | Record type alias |
created_at |
date | Created |
expires_at |
date | Expires |
id |
number | Id |
last_accessed_at |
date | Last accessed |
name |
text | Name |
record_url |
text | Record URL |
scopes |
text | Scopes |
updated_at |
date | Updated |
These optional placeholders are also available with key expansion in dictionaries and the API:
| Field | Type | Description |
|---|---|---|
comment_count |
number | Comment count on the record |
comments |
comments | Comments |
custom_<id> |
mixed | Custom Fields |
links |
links | Links |
watchers |
watchers | Watchers |
Search Query Fields
These filters are available in service token search queries:
| Field | Type | Description |
|---|---|---|
created: |
date | Created |
expires: |
date | Expires |
fieldset: |
record | Fieldset |
id: |
number | Id |
lastAccessed: |
date | Last accessed |
links: |
links | Record Links |
name: |
text | Name |
scopes: |
text | Scopes |
updated: |
date | Updated |
watchers: |
record | Watchers |
Worklist Columns
These columns are available on service token worklists:
| Column | Description |
|---|---|
cf_<id> |
Custom Field |
s_created_at |
Created |
s_expires_at |
Expires |
s_id |
Id |
s_last_accessed_at |
Last accessed |
s_name |
Name |
s_scopes |
Scopes |
s_updated_at |
Updated |