Skip to main content
Version: next

Import tokens from a file

Bulk import tokens from CSV, XLSX, JSON, or YAML files. This is the fastest way to migrate from spreadsheets or to load an export from another system.

Open Import tokens from the dashboard and pick the file card, or use the REST API.

Import tokens modal showing the file card and integration providers The Import tokens modal: file upload plus integration providers.

Formats and fields​

Required fields:

  • name (3-100 characters), category, type

Optional fields:

  • expiresAt (format YYYY-MM-DD, for example 2026-12-31; if omitted or null, defaults to Never expires, stored as 2099-12-31)
  • section, domains, location, used_by, contacts, description, notes, contact_group_id
  • Certificates: issuer, serial_number, subject
  • Keys: key_size (positive integer), algorithm
  • Licenses: license_type, vendor, cost, renewal_url, renewal_date

The workspace is taken from your current selection, so the file does not include a workspace_id.

tip

Include a location column for reliable deduplication: re-importing a row with the same name + location updates the existing token instead of creating a duplicate.

CSV / XLSX example​

name,category,type,expiresAt,section,domain,privileges,last_used
Example TLS Cert,cert,ssl_cert,2026-01-31,"prod, public",example.com,,
API Gateway Key,key_secret,api_key,2025-12-15,"prod, api",api.example.com,"read, write",2025-06-10

JSON example​

[
  {
    "name": "Example API Key",
    "category": "key_secret",
    "type": "api_key",
    "expiresAt": "2026-05-15",
    "section": "backend, internal",
    "domain": "service.example.com",
    "privileges": "read:all, write:logs",
    "last_used": "2025-11-20"
  }
]

YAML example​

tokens:
  - name: Example TLS Cert
    category: cert
    type: ssl_cert
    expiresAt: 2026-01-31
    section: prod, external
    privileges: 'read, sign'
    last_used: 2025-10-15
    domains:
      - example.com
      - www.example.com
    issuer: "Let's Encrypt"
    location: /etc/ssl/certs
    used_by: edge-proxy

Behavior on import​

  • Deduplication: rows matching an existing token on name + location update that token. See Automatic deduplication.
  • Alert catch-up: alerts for thresholds that have already passed are suppressed to prevent notification storms; alerting resumes at the next future threshold.
  • No caps: self-hosted TokenTimer has no plan limits, so imports are not blocked by a token quota.