API tokens¶
System → API Tokens (admins only) manages the tokens that other services – Dovecot, Postfix, Roundcube, Keycloak – use to talk to Userli.
Create a token¶
Click Create, enter a descriptive name (for example Dovecot mx1) and
select one or more scopes:
| Scope | Used by |
|---|---|
dovecot |
Dovecot – login and mailbox lookups |
postfix |
Postfix – domains, mailboxes, aliases, SMTP auth |
roundcube |
Roundcube – alias lookup |
keycloak |
Keycloak – single sign-on |
retention |
Retention – activity of external services |
Copy the token immediately
The token is shown only once after creation. Userli only stores a hash. Hand it to your server operator through a secure channel.
Good practice¶
- Create one token per service and server, with only the scopes it needs.
- The list shows when each token was last used. Delete unused tokens.
- If a token leaked, delete it and create a new one.