Skip to main content
Version: 0.15

Token model

Tokens represent any asset with an expiration date that you cannot afford to miss: certificates, API keys, secrets, contracts, licenses, memberships. Each token lives inside a specific workspace. Alerts use the workspace defaults (thresholds and enabled channels); recipients and, optionally, thresholds can be overridden per token by selecting one or more contact groups.

What "token" means here

A TokenTimer token is the item being tracked, not a credential. Credentials that authenticate against TokenTimer's API are called machine API tokens (see Executor API). Credentials you supply for a manual integration scan are used once and not stored; scheduled auto-sync (where entitled) stores those credentials encrypted at rest for re-scans.

  • Lifecycle: create the token with an expiration date, TokenTimer tracks status and sends alerts as thresholds are reached, then marks it expired if the date passes.
  • Visibility: color-coded status in the dashboard and usage views to prioritize renewals.
  • Ownership: who receives alerts comes from the token's contact groups (named lists of recipients and channels). Assign one or more groups when plural writes are enabled; overlapping recipients are deduplicated. By default, the workspace's initial contact group is used (owner's email).

Fields and categories​

Every token needs a name, category, and type. You can also add an expiration date, organize tokens into sections, and include additional details.

Required:

  • Name: a descriptive name for your token (3-100 characters)
  • Category: one of: Certificates, Keys & Secrets, Licenses, or General (API values: cert, key_secret, license, general)
  • Type: the specific type within the category (for example SSL certificate, API key, software license)

Optional:

  • Expiration date: when the token expires (if left empty, the token is marked as "never expires")
  • Section: group related tokens together (for example "Production", "Development")
  • Description & notes: helpful context or reminders
  • Contacts: people to notify about this token

Category-specific details:

  • Certificates: domains, issuer information, and certificate details
  • Keys & Secrets: where they are stored and rotation instructions
  • Licenses: vendor name, number of seats, renewal dates, and costs
Token detail view for an SSL certificate showing basic information and certificate details Token detail view: basic information, section, contact groups, and category-specific certificate details.

Workspace scoping​

Default thresholds and channels are configured at the workspace level. Recipients and (optionally) thresholds may be overridden by assigning a token to one or more contact groups. Role-based access means only members of the workspace can view or manage its tokens.

  • Changing workspace default thresholds affects tokens that do not use a group thresholds override.
  • Use sections to reflect environments or teams (for example Production vs. Staging) and filter views.
  • Assign contact groups to route alerts to the right teams and, if needed, apply different thresholds policies (union of effective thresholds across assigned groups).
  • Self-hosted TokenTimer has no plan tiers or token caps: workspaces can hold as many tokens as your database can store.

Getting tokens into TokenTimer​

Beyond creating tokens one by one in the dashboard, you can: