Workspace tokens

A workspace token (sk_ws_…) authenticates requests for workspace resources. Currently, workspace tokens support the domains API, the DNS API, and reading the wallet balance. For deploying and managing services, use a project token (sk_proj_…) instead.

Create one

A workspace owner creates it in the console, under Settings → Tokens → Workspace Tokens. The key is shown once, when it is created: copy it then and keep it somewhere safe, such as your CI's secret store.

Send it as a bearer token:

Authorization: Bearer sk_ws_01j2k3...

Keep the token on your server. It can spend the workspace wallet. Never put it in browser code, a mobile app, or a repository.

What a token can reach

A token works only in the workspace it was made for, and only on the routes its scopes allow. There are two scopes, domains and dns. A token made before dns was added has only domains: create a new one to manage DNS records.

With the `domains` scope
Search, quote, list and get domains	Allowed
Buy and renew, paid from the wallet	Allowed, with the price confirmed
Turn auto-renew and the transfer lock on or off	Allowed
Read the saved registrant	Allowed
Buy as a registrant other than the saved one	Refused
Change the saved registrant	Refused
Reveal a domain's transfer code	Refused: it moves the domain out of the workspace

With the `dns` scope
List and get zones, and check a pending zone's delegation	Allowed
List, add, change and delete records	Allowed, except `platform` records, which can only be read
Add or delete a zone	Refused: deleting one takes its domain offline

With any scope, or none, a token can read the wallet balance, but it cannot fund the wallet. Creating or deleting tokens, and anything else outside these two tables, is refused.

Requests outside the token scope return 403:

{
  "success": false,
  "message": "Forbidden",
  "error": "workspace token is not authorized for this resource"
}

Whose authority it carries

A token acts as the owner who created it, and never with more authority than they have. If they leave the workspace, their tokens stop working at once. If they are given a role that cannot buy domains or change DNS, their tokens can still read domains and DNS records but can no longer buy, renew or change them. Deleting the workspace deletes its tokens.

Find the workspace a token is for

GET https://api.cloud.simplifyd.com/v1/auth/scope

A script holding only the token can ask which workspace it belongs to, rather than being configured with both:

curl https://api.cloud.simplifyd.com/v1/auth/scope \
  -H "Authorization: Bearer $SIMPLIFYD_WORKSPACE_TOKEN"

{
  "kind": "workspace_token",
  "workspace": "0192e7a0-55c1-7b3e-8f2d-4a1b6c9d0e12",
  "workspace_name": "Acme"
}

workspace is the id that goes in domain and DNS paths.

Revoke one

Delete the token from Settings → Tokens → Workspace Tokens. Subsequent requests using it return 401.

Managing tokens over the API

The console manages tokens with the endpoints below. They take a signed-in owner's session, not a token: a token can never create or delete tokens.

BASE = https://api.cloud.simplifyd.com/v1/workspaces/{workspace}/tokens

List tokens

GET {BASE}

Any member of the workspace can list its tokens. Keys are never returned, only a masked form.

200 OK

{
  "tokens": [
    {
      "slug": "0192f3e0-7d21-7f4a-9b6c-2e1d0c3b4a59",
      "name": "Domain automation",
      "scopes": ["domains", "dns"],
      "masked_key": "sk_ws_********c60d",
      "created_by": { "slug": "0192e7a0-1a2b-7c3d-8e4f-5a6b7c8d9e0f", "name": "Ada Obi" },
      "last_used_at": "2026-10-14T10:02:11Z",
      "created_at": "2026-10-14T09:15:40Z"
    }
  ]
}

last_used_at is null for a token never used. It is updated at most once a minute.

Create a token

POST {BASE}
Content-Type: application/json

Owners only.

Field		Description
`name`	Required	What the token is for, shown in the list.
`scopes`	Optional	The scopes to give it. Defaults to every scope: `["domains", "dns"]`.

{ "name": "Domain automation", "scopes": ["domains", "dns"] }

201 Created. The only response that carries key:

{
  "token": {
    "slug": "0192f3e0-7d21-7f4a-9b6c-2e1d0c3b4a59",
    "name": "Domain automation",
    "scopes": ["domains", "dns"],
    "key": "sk_ws_0192f3e07d217f4a9b6c2e1d0c3b4a59b3fd8ade...c60d",
    "masked_key": "sk_ws_********c60d",
    "created_by": { "slug": "0192e7a0-1a2b-7c3d-8e4f-5a6b7c8d9e0f", "name": "Ada Obi" },
    "last_used_at": null,
    "created_at": "2026-10-14T09:15:40Z"
  }
}

An unknown scope answers 400. A member who is not an owner gets 403.

Delete a token

DELETE {BASE}/{token}

Owners only. {token} is the token's slug.

200 OK

{ "success": true }

A token that does not exist, or was already deleted, answers 400 with "message": "token not found".

Workspace tokens

On this page