API Tokens
Create, scope, rate-limit, and revoke personal Sanctum API tokens from Admin.
Overview
API Tokens manages the current user’s Sanctum personal access tokens — create with abilities, edit scopes/rate limits, and revoke.
Where it lives
Route: /admin/settings/api (admin.settings.api)
Open Admin → Users & Security → API Tokens. Requires admin access; tokens are scoped to auth()->user().
Key workflows
| Action | Behaviour |
|---|---|
| Create Token | Name, ability checkboxes from AbilityRegistry, optional rate limit (1–10000 req/min) |
| Show once | Plain-text token shown once with copy — cannot be retrieved later |
| Edit scopes | Update abilities and rate limit without rotating the secret |
| Revoke | Confirmation modal; deletes the token |
Abilities use resource:action keys. A token cannot exceed what the creating user may grant.