Skip to main content
With an API token, the Laravel package, a GitHub Action or your own scripts talk to a project, for example to push new keys and fetch translations. A token belongs to the project, not to a person: a pipeline keeps working when a colleague leaves. Only managers manage tokens, under Settings › API tokens (Instellingen › API-tokens).

​
Creating a token

1

Create the token

Click Create token (Token aanmaken). Create one token per use, for example “GitHub Actions” and “Local development”, so you can revoke one without affecting the rest.
2

Choose permissions

  • Read only (Alleen lezen, read): fetch the project, keys, translations and exports.
  • Read and write (Lezen en schrijven, read and write): also push keys, update translations and import.
3

Expiry date

By default 12 months ahead, at most 24 months ahead. Two weeks before the expiry date, the project’s managers get an email.
4

Copy the token

Tolk shows the token once. Put it in your .env or in your GitHub secrets right away. If you lose it, create a new token.
.env
A token always starts with tolk_. This lets GitHub secret scanning and code reviews recognize a token that ends up in code by accident.
Never put a token in git, a ticket or a chat. Tolk itself only stores a hash: nobody can view the token later.

​
Overview and revoking

For each token, the table shows the permissions, when and from which IP address it was last used, and when it expires. A token that expires soon is highlighted. Choose Revoke (Intrekken) in a token’s menu to make it unusable immediately. Anyone still using it gets an error from the API.

​
Good to know

  • A project has at most 20 active tokens.
  • A token of an archived project does not work until the project is restored. A token of a deleted project or a deleted customer never works again.
  • An expired token disappears from the list after 30 days.
  • Every write action with a token is recorded in the audit trail, with the token’s name.

​
A leaked token

1

Revoke

Revoke the token immediately.
2

New token

Create a new token with the same permissions.
3

Replace

Replace the secret in GitHub or in the .env of whoever used it.
How to use a token in code is described under Authentication.