A Melbicom API token grants read and write access to everything on your account, so review its controls right after you create it. This tutorial covers the three controls on the API Tokens page: restricting the token to known IP addresses, reviewing what it can call, and deactivating it.
Prerequisites
- A Melbicom account with an active API token. To create one, follow Create Your Melbicom API Token.
Step 1: Read the Token Card
In the client area, open the account menu at the top right and choose API Tokens. Read the token’s status, its creation and expiry dates, and the last request with its source IP. The last request line is your quickest check that nothing unexpected is using the token:
Step 2: Restrict the Token by IP
By default the token works from any IP. Click Edit next to the IP restriction status and list the addresses your scripts call from, one per line; IPv4, IPv6 and CIDR ranges are all accepted.
Click Save: the restriction applies to the current token immediately. Leave the list empty to allow any IP again.
IP restriction is standard security practice for API credentials with fixed callers: a leaked token is useless from anywhere outside the listed addresses. Restrict every token whose callers have stable IPs, such as your servers or your CI runners.
Step 3: Review What the Token Can Call
Review the operations listed under What this token can call: every API method and path the token can use. The token has no per-endpoint scopes: it grants read and write access to all data and settings the API exposes, which is why the IP restriction above and careful storage matter. Use the list as your inventory of what a leaked token could reach.
Step 4: Deactivate or Rotate the Token
When you retire a token, or suspect its value has been exposed, click Deactivate token. Deactivation is immediate and there is no confirmation step, so make sure nothing you depend on is still using it. Scripts calling with the old value start receiving authentication errors on their next request.
Rotation is deactivation plus creation: deactivate the token, generate a new one, and update your secret store. Rotate on a schedule, and immediately whenever the value may have been exposed, in a log, a repository or a shared terminal.
What You Have
A token restricted to your own addresses, a clear inventory of what it can reach, and a rotation you can perform at any moment. The last request line on the token card remains the routine check: it confirms that only your own systems are using the token.