API Tokens and Agent Identities

BlazeXL supports long-lived and temporary access tokens for API clients, services, and agents.

The important design principle is simple:

Automations should use dedicated identities, not borrowed human credentials.

Recommended Setup

For production automations and agent workflows:

1. Create a dedicated user for the service, bot, or agent
2. Add that identity to the correct organization and teams
3. Grant only the roles and Block access it actually needs
4. Generate an API token from the BlazeXL workspace token page
5. Mark attribution appropriately as Human or Agent / Bot

This gives the automation:

• the right RBAC scope
• a stable audit identity
• clean operational separation from human users

Why Dedicated Identities Matter

Dedicated identities improve:

• security: no shared personal tokens
• auditability: activity is attributable to the right actor
• governance: RBAC applies cleanly to automations
• operations: tokens can be rotated or revoked without affecting users

Token Types

Long-Term Tokens

Use these for:

• backend services
• workflow engines
• scheduled jobs
• internal agents

They provide stable access for approved integrations and do not require frequent reauthorization.

Temporary Tokens

Use these for:

• short-lived development tasks
• testing sessions
• temporary automation contexts

A temporary token lasts 24 hours (1 hour for an organization pinned to a deployment) and cannot be renewed. One is created only when you click Create temporary token; the page shows its id and expiry.

What a Token Is Bound To

Every access key and temporary token is bound, when it is created, to:

• the organization that is active when you create it
• its client type: Excel add-in or SDK / API
• its actor type: Human or Agent

It works only for that organization and client. Another organization or client is refused, so a key made for one organization's add-in cannot be used elsewhere. The token page says what a new key will be bound to before you create it, and lists what each existing one is bound to.

Revoking Tokens

The Access tokens page lists every access key and temporary token you hold, with its client, actor, organization, creation date, last use and expiry.

• Revoke stops one key or temporary token. Clients using it stop within 60 seconds.
• Revoke all stops every temporary token, every signed-in session (including the browser you use) and every access key you do not choose to keep. You sign in again afterwards.
• An organization admin can revoke a member's keys and temporary tokens for that organization from the Organization page (Revoke tokens). Suspending or removing a member also revokes them.
• Changing or resetting your password revokes them too.

Attribution

When generating an API token, BlazeXL allows you to specify whether the token is for:

• Human
• Agent / Bot

This controls how activity is represented in audit logs and helps organizations distinguish between user-driven and automation-driven execution.

Relationship to RBAC

Tokens do not bypass governance.

They inherit the permissions of the identity they belong to, including:

• organization membership
• team membership
• role-based access
• access to published Blocks and governed assets

This means a dedicated agent user can be given access only to the logic it is allowed to run.

Best Practices

• use one identity per major automation or agent
• avoid shared tokens across unrelated workflows
• keep machine identities scoped to the minimum necessary permissions
• rotate long-lived tokens on a schedule, and revoke the ones you no longer use
• review agent activity regularly in audit

Next Steps

• Governed API and Agent Access
• Audit and Attribution for Agent Activity