Tokens
Preview tokens, personal tokens and org API keys, and how to expire or revoke them.
There are three kinds of token. Each is shown only once, when you create it.
| Kind | Prefix | Created at | Who |
|---|---|---|---|
| Draft preview | flr_prev_ | /org/<org-slug>/settings/api-keys | org admins only |
| Org API key | flr_org_ | /org/<org-slug>/settings/api-keys | org admins only |
| Personal token | flr_ | /settings/tokens | any signed-in user |
Most people only need draft preview: it lets an embed show an unpublished draft and nothing else. See Embeds.
A personal token works across all your organizations. An org API key belongs to the organization and keeps working if the admin who created it leaves.
Anyone who loads a page with <Shader draft={…} /> can see the token. Use
draft embeds on previews and staging only, and give the token an expiry.
Creating one
Give it a name and, optionally, an expiry of 1 to 365 days. Without one it never expires.
Copy the token right away: afterwards the list only shows its start, like
flr_a1b…. If you lose it, revoke it and create a new one.
Expiry and revocation
A token stops working as soon as it expires.
Revoke stops it immediately and can't be undone. Revoked tokens stay in the
list, crossed out. Revoke personal tokens from /settings/tokens, and org keys
and preview tokens from the organization's API keys page.