API Tokens and Scopes
Understand team tokens, organization tokens, one-time secrets, expiry, and token validation
API tokens let external systems call MonitoringDog APIs without using a browser session. Use tokens for automations, integrations, and custom incident triggers.
Token levels decide ownership
MonitoringDog supports two token levels.
| Level | Owner | Use when |
|---|---|---|
| Team token | Current team | The external system should operate inside one team |
| Organization token | Current organization | The external system needs organization-level access |
Some API flows require a team-level token because the API must resolve a specific team context.
Token secrets are shown once
When MonitoringDog creates a new API token, the plaintext token secret is returned once. MonitoringDog stores only a hash of the secret.
If you lose the plaintext secret, create a replacement token and delete the old one. MonitoringDog cannot recover the original secret.
Scope and expiry
Programmatic tokens expose these fields:
| Field | What it controls |
|---|---|
| Scope | Whether the token has full access or read-only access |
| Expires at | Optional absolute expiry time |
| Last used at | Last successful validation time |
The current portal creation form focuses on token name and level. Programmatic scope and expiry fields are available through the REST API.
Token validation resolves team context
When an API token is presented, MonitoringDog validates the secret, checks expiry, and resolves the owning team for team-level tokens.
Expired or invalid tokens are rejected.