How do you create a token?

Send POST /api/manage/keys with an existing token. It takes no request body. The 201 response holds the new token’s id, which you use to revoke it later, and the token itself, which can’t be shown again, so put it in your secret store straight away.

Create a token
curl -X POST 'https://app.kawlnow.com/api/manage/keys' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_TOKEN'

# Response 201, shown once:
# {"id": "TOKEN_ID", "token": "NEW_WORKSPACE_TOKEN"}

What does a token look like?

A token is hl_sk_ followed by 64 lowercase hexadecimal characters. That fixed shape lets a secret scanner find tokens in code, logs and tickets with the pattern hl_sk_[0-9a-f]{64}.

Kawl Now keeps a SHA-256 hash of each token and its first 14 characters, its prefix, such as hl_sk_1a2b3c4d. The prefix identifies the token in your list and in emails, and it isn’t a secret.

How do you list tokens?

GET /api/manage/workspace returns a keys array, newest first. Each entry has the token’s id, prefix and created_at. The full token and its hash are never returned, and tokens have no names or last-used dates, so keep a note of which tool holds which prefix.

The keys array in the workspace response
{
  "keys": [
    {
      "id": "TOKEN_ID",
      "prefix": "hl_sk_1a2b3c4d",
      "created_at": "2026-10-08T09:00:00.000Z"
    }
  ]
}

How do you revoke a token?

Send DELETE /api/manage/keys/{id} with the id from the keys list. The token stops working at once, and the response is {"ok": true}. Any token can revoke any other in the workspace, and itself, so revoke the one you’re calling with last.

An id that doesn’t match a token in your workspace also returns {"ok": true} and changes nothing, so read the keys list afterwards to confirm.

Revoke a token
curl -X DELETE 'https://app.kawlnow.com/api/manage/keys/TOKEN_ID' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_TOKEN'

# Response 200: {"ok": true}

Which emails do token changes send?

Creating or revoking a token emails the workspace owner’s sign-in address. The email names the token by its prefix and says how the change was made: in the dashboard, or with another token, which it also names by prefix. Notices are rate-limited, so a burst of changes can send fewer emails than there were changes.

How do you replace a token without downtime?

Create the new token before you revoke the old one:

  • Create a token with POST /api/manage/keys and note its id and prefix.
  • Put it in the tool’s secret store, then restart or redeploy the tool.
  • Check that the tool works, for example with GET /api/manage/workspace.
  • Revoke the old token with DELETE /api/manage/keys/{id}.
  • Read the keys list to confirm that only the tokens you expect remain.