Admin Tokens vs User Tokens

Admin-capable tokens belong to users whose role is accepted by pc_admin_roles(): owner, super_admin, admin, reseller, or support. User tokens can still authenticate, but many resources are filtered to hosting accounts owned by that user. Admin-only endpoints return 403 for non-admin users.

Practice

• Name tokens after the integration, not after the person who created them.
• Use comma-separated scope labels that describe intended access.
• Avoid using * for third-party systems unless there is a clear provider-level reason.
• Document who owns the integration and where the token is stored.

PCAdmin

Use PCAdmin → API Tokens to create and review token names, scope labels, status, last used time, and expiry.

Troubleshooting

• For 401, verify token validity and user status.
• For 403, check whether the endpoint requires an admin-capable role.
• For empty results, check whether the token user owns any hosting accounts.