Access tokens

Access tokens belong to one account and have explicit scopes. Treat the token value as a secret.

Common scopes

Scope	Use
ingest:write	Send to one bound shared receiver.
logs:read	Read retained logs through the Stream API.
analytics:read	Read histograms and facets.

The product also offers an Agent read-only preset for logs:read and analytics:read.

Receiver-bound ingest tokens

An ingest token must be bound to the same active shared receiver used by the sender. The binding cannot be changed later; create a new token when the receiver changes.

Dedicated receivers use source IPv4 or CIDR rules instead of access tokens.

Store tokens safely

• Put tokens in environment variables or your secret manager.
• Do not place token values in tracked configuration files, screenshots, or support messages.
• Grant only the scopes needed by the sender or reader.
• Delete a token that may have been exposed, then update the sender.

Stream API authentication

Customer Stream requests need both headers:

Authorization: Bearer YOUR_TOKEN
X-Active-Account: YOUR_ACCOUNT_UUID

The account must match the token’s verified account.