External Access Tokens

Use the query-parameter form only when you can't set headers — for example, a
service that only takes a URL. URLs with tokens often end up in proxy logs,
shell history, and screenshots, so prefer the header form whenever you can.

## Manage existing tokens

The **External access tokens** section lists every token you've created for
the app — newest first — along with its label, environment, creation date,
expiry, and revocation status. The last few characters of the token are shown
on each row to help you tell tokens apart, since the full value is only ever
displayed at creation time.

You only see tokens *you* created. Other collaborators' tokens are private to
them, even if you own the app.

## Revoke a token

Revoke a token whenever it's no longer needed, or as soon as you suspect it
may have leaked. To revoke:

<Steps>
  <Step>
    Open the **External access tokens** section in the app's publishing settings.
  </Step>
  <Step>
    Find the token in the list and select the trash icon.
  </Step>
  <Step>
    Confirm the revocation.
  </Step>
</Steps>

Revocation is **immediate and irreversible**. Any traffic still using the
token starts getting rejected within seconds. If you need access again, mint a
new token.

You can only revoke tokens you created yourself. Removing a collaborator from
the workspace automatically revokes the tokens they minted for that app.

## Keep your tokens safe

External access tokens are credentials. Handle them with the same care you'd
give an API key or password.

### Do

- **Store tokens in a secret manager** — GitHub Actions secrets, your CI
  vendor's vault, your cloud provider's secret store, or a password manager.
  Never commit them to a repository.
- **Use short lifetimes** when you can. A 7-day token for a one-off
  integration is safer than a 5-year token left lying around.
- **Label every token** so future-you knows what it's for and whether it's
  still in use. Unlabeled tokens are the first ones to leak and the last ones
  to get revoked.
- **Mint a separate token per consumer.** One token per CI job, one per
  webhook source, one per uptime check. When something gets compromised — or
  a vendor is no longer needed — you revoke just that one.
- **Prefer the `Authorization` header** over query parameters so the token
  doesn't leak through URL logs, browser history, or referer headers.
- **Revoke immediately** if a token might have been exposed — a leaked log,
  a public repository commit, a screen-share, a former employee's laptop.
  Revocation takes effect right away; mint a replacement afterwards.

### Don't

- **Don't share a token across teammates or services.** If two systems share
  one token, you can't revoke one without breaking the other.
- **Don't paste tokens into chat, email, screenshots, or issue trackers.**
  These channels get archived, indexed, and shared in ways you can't predict.
- **Don't embed tokens in client-side code** — browser apps, mobile apps,
  desktop binaries. Anything shipped to a user's device should be considered
  public.
- **Don't rely on tokens for browser sessions.** Tokens work for API calls,
  not for loading SPAs in a browser tab. Use a normal Replit sign-in for that.
- **Don't pick a 5-year expiry by default.** Match the lifetime to how long
  the consumer actually needs access.

## Troubleshooting

<Accordion title="My production token suddenly stopped working">
  Production tokens are bound to a specific published deployment. If you
  re-published the app — for example, by changing deployment type or
  destroying and recreating the deployment — existing production tokens are
  invalidated. Mint a new token from the new deployment's settings.
</Accordion>

<Accordion title="My token works for `curl` but my browser still shows the sign-in page">
  External access tokens are intended for API traffic, not for browser
  sessions. When a single-page app loads in a browser, the initial HTML
  request can carry the token via query parameter, but follow-up requests for
  JavaScript bundles, CSS, and API calls won't include it and will be
  rejected. To browse the app interactively, sign in to Replit normally.
</Accordion>

<Accordion title="I lost the token — can I see it again?">
  No. Replit only shows the token once, at creation time. The list view shows
  metadata (label, environment, expiry, last few characters) but never the
  full token value. If you lost it, revoke that token and create a new one.
</Accordion>

## Next steps

- [Private Deployments](/cloud-services/deployments/private-deployments):
  the underlying access-control feature these tokens bypass.
- [Replit App Access Management](/teams/identity-and-access-management/repl-access-management):
  manage which Replit users can sign in to your private apps.