Provider-Level Access

Provider-level integrations should use a token attached to an admin-capable user and should be limited by network policy, secret management, and short expiry periods. Use admin tokens for provider monitoring, security review, and billing reconciliation.

Practice

• Name tokens after the integration, not after the person who created them.
• Use comma-separated scope labels that describe intended access.
• Avoid using * for third-party systems unless there is a clear provider-level reason.
• Document who owns the integration and where the token is stored.

PCAdmin

Use PCAdmin → API Tokens to create and review token names, scope labels, status, last used time, and expiry.

Troubleshooting

• For 401, verify token validity and user status.
• For 403, check whether the endpoint requires an admin-capable role.
• For empty results, check whether the token user owns any hosting accounts.