API tokens are used to authenticate requests to the Okta API. An API token is issued for a specific user and all requests with the token act on behalf of the user. API tokens are secrets and should be treated like passwords.
API tokens are generated with the permissions of the user that created the token. If a user’s permissions change, then so do the tokens. Super admins, org admins, group admins, group membership admins, and read-only admins may create tokens.
- API Token
- Password Policy
The API token does not expire, along with the user's password. As long as the Okta user account that created that token does not get deactivated or deleted, the API token will not be affected. The next time the user account is used to sign into Okta, it will be asked to set up a new password.
