Account-Level Access

Many resource endpoints check whether the authenticated user is admin-capable. If not, they call account-id filtering helpers and return only records attached to accounts owned by that user. This is the current practical data boundary for customer and reseller-style tokens.

Practice

• Name tokens after the integration, not after the person who created them.
• Use comma-separated scope labels that describe intended access.
• Avoid using * for third-party systems unless there is a clear provider-level reason.
• Document who owns the integration and where the token is stored.

PCAdmin

Use PCAdmin → API Tokens to create and review token names, scope labels, status, last used time, and expiry.

Troubleshooting

• For 401, verify token validity and user status.
• For 403, check whether the endpoint requires an admin-capable role.
• For empty results, check whether the token user owns any hosting accounts.