Token Management API

In addition to manually managing them on the console “Tokens” page, 4ALL API also supports programmatic API token management, which is suitable for scenarios where quotas are automatically provisioned and reclaimed by customer/project.

Authentication

The token management API is an account-level operation and uses system access token authentication (Console → Personal Settings → Generate System Access Token):

-H "Authorization: System Access Token"

Caution

System access tokens have account-level permissions. Use them only on the server side, and never expose them to the client or write them into front-end code.

Common Endpoints

Method	Path	Purpose
GET	/api/token/	List all tokens
GET	/api/token/{id}	Query a single token
POST	/api/token/	Create a token
PUT	/api/token/	Modify a token (quota, expiration time, status)
DELETE	/api/token/{id}	Delete a token

Create Token Example

curl -X POST https://api.4allapi.com/api/token/ \
  -H "Authorization: $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "customer-a",
    "remain_quota": 500000,
    "expired_time": -1,
    "unlimited_quota": false
  }'

• expired_time: expiration timestamp, -1 means never expires;
• remain_quota: token quota (internal units);
• After creation, obtain the sk- key from the response/list API and deliver it to the corresponding business system.

Typical Usage

• SaaS scenario: one token per end customer, with independent quotas that are renewed and adjusted along with the subscription;
• CI/temporary tasks: create short-lived tokens with an expiration time, which become invalid automatically when they expire;
• Security response: when a key is suspected to be leaked, use PUT to disable it or DELETE to remove it immediately and limit the damage.