API token
An API token authenticates programmatic access to a project. Each token combines two layers of access control:
- A Role that defines what actions are permitted (the same Role resource used for human collaborators).
- A set of API surface flags (
can_access_cda,can_access_cda_preview,can_access_cma) that gate which APIs the token can hit at all.
The token's effective capabilities are the intersection of the two.
A token with only can_access_cda: true is safe to attach to a Role that grants update/publish/delete — the Content Delivery API exposes no write endpoints, so those actions have no surface to act on. This makes it practical to share a single Role definition between an editor (acting via the dashboard / CMA) and a public read token (used by a frontend / CDA) for the same project.
Object payload
ID of access_token
"312"
Must be exactly "access_token".
Name of API token
"Read-only API token"
Internal marker for the project's built-in factory tokens (e.g. read-only API token), seeded by DatoCMS when the project is created. Read-only attribute. When non-null, attribute updates are rejected with NON_EDITABLE_ACCESS_TOKEN, but the token can still be deleted and regenerated. null for any token created via this API.
Whether this API token can call the Content Delivery API (graphql.datocms.com) to fetch published content.
Whether this API token can call the Content Delivery API with the X-Include-Drafts: true header to fetch draft (current, unpublished) content. There is no separate endpoint — the CDA is a single GraphQL endpoint and this flag governs whether requesting drafts is allowed.
Whether this API token can access the Content Management API
When this API token was last used to access the Content Management API
"never"
Today
Yesterday
This week (Monday-Sunday)
Last week (Monday-Sunday)
This calendar month
Last calendar month
No recent usage (beyond last month)
When this API token was last used to access the Content Delivery API
"never"
Today
Yesterday
This week (Monday-Sunday)
Last week (Monday-Sunday)
This calendar month
Last calendar month
No recent usage (beyond last month)
The secret value used as the Authorization: Bearer <token> credential. Returned on every endpoint (create, update, retrieve, list, rotate) to callers whose current role has can_manage_access_tokens; otherwise null.
"XXXXXXXXXXXXXXX"