API Tokens

API tokens let you connect external systems, scripts, and tooling to the Mirox platform with scoped, revocable credentials that never expose your password. Each token authenticates machine-to-machine requests on your behalf, so you can export metrics and automate your integrations without sharing your login.

Token Concept

Every token belongs to the user who created it and behaves as that user, within limits:

Tied to your account — a token acts on your behalf, and everything it does is attributed to you in the audit trail.
Permission ceiling — a token can never reach anything you cannot reach yourself. Your own role and resource access always cap what the token sees.
Scoped by permission group — you pick a permission group at creation time to narrow the token further (see below).
Shown once — the full token value is displayed a single time when you create it. Store it securely; Mirox keeps only a hashed copy and can never show it again.
Made for automation — a token is never asked for a second factor and is not ended by the sign-in rules of your organization. See Tokens and Two-Factor Authentication.

This keeps automation accountable: even if a token is compromised, it is limited to one scope, easy to revoke, and isolated from your other tokens.

Permission Groups

When you create a token you choose one permission group that defines what it may do:

Group	What the token can do
Full Access	Acts with your complete access — every API surface you can reach.
Metric Export	Read the data export only: metrics as time series, export templates, the metric catalog, plant information and events. It cannot change anything.
Timeseries Database	Read the raw measurement series only.

A group never widens your access; it only narrows the token relative to your own permissions. For the full definition of each group, see the API permission groups section of the permission system documentation.

Match the group to the job

Give each integration the narrowest group that still works. A workbook or a script that reads exports needs only Metric Export; a client that reads the raw measurement series needs only Timeseries Database. This limits the blast radius if a token leaks.

Creating and Managing Tokens

You manage your tokens from your profile. The platform covers the full lifecycle:

Creating a Token

Name and description — a clear label and note so you remember what each token is for.
Permission group — choose one of the groups above.
Expiration — optional. Tokens default to a one-year lifetime, and you can set any expiry up to a maximum of five years.
One-time reveal — the complete token is shown once at creation, then never again.

You can hold up to 64 active tokens per account.

Create and rotate in the browser

You create and rotate tokens in the browser, signed in to Mirox. You cannot use one API token to create or rotate another — this prevents a leaked token from quietly creating more.

Rotating a Token

Rotation replaces a token's secret in place without changing its name, description, or permission group:

A new secret is issued and shown once.
The old secret stops working immediately.
The expiry resets and usage history is cleared.

Rotation is the recommended way to refresh long-lived integrations on a schedule, or to respond to a suspected leak, without reconfiguring which integration uses which token.

Monitoring and Revoking

Inventory — list all your tokens with their name, permission group, creation and expiry dates.
Usage insight — see when each token was last used, along with the IP, location, browser, and operating system captured at that time. The token value itself is never re-shown.
Immediate revocation — delete a token to invalidate it instantly. Revoking one token never affects the others.

Tokens and Two-Factor Authentication

An API token is made for scripts and integrations that run without a person at the keyboard. The sign-in rules for people therefore do not apply to it:

No second factor. A token is never asked for a code, whether or not your account has two-factor authentication (2FA).
Not ended by sign-in rules. Your organization can set how long a sign-in to the web app and the mobile app lasts. A token is not a sign-in: it keeps working until its own expiry date, or until you rotate or revoke it. Being signed out does not stop your tokens.
Not changed by a 2FA requirement. When an organization requires 2FA for plant access, that rule applies to people signed in to the web app and the mobile app. It does not change what an existing token can reach.

One rule does apply: while your own organization requires 2FA and your account has no second factor, you cannot create a new token. Enable 2FA first (authenticator app or passkey) — see Two-Factor Authentication. Your existing tokens keep working in the meantime.

Because a token is not protected by a second factor, treat it like a password: store it safely, give it the narrowest permission group, set an expiry, and revoke it when it is no longer needed. For the organization's rules, see Organization Security Policy.

Common Use Cases

API tokens support a wide range of integration scenarios.

Metric Export

A Metric Export token reads every link of the Metric Export and of the legacy export:

Refresh Excel workbooks and BI dashboards from an export link.
Feed production and performance data into data warehouses and analytics pipelines.
Build your own reports from exported data.

The token cannot create or change templates, metrics or anything else. The reports Mirox generates itself are not driven by API tokens: they are generated, published and downloaded in the app.

Time-Series Metrics Access

Read the raw measurement series of your plants, the same series Grafana reads.
Connect read-only analytics tooling that speaks the query language of the time-series store.

Security and Control

Token isolation — a compromised token never exposes your password or your other tokens.
Scheduled rotation — rotate long-lived tokens periodically using the rotate action, keeping the same configuration.
Time-limited validity — set an expiry so abandoned tokens age out automatically.
Full attribution — every action a token takes is logged against you, so usage stays accountable and auditable.

Permission System — how permission groups and access control work
Metric Export — what a Metric Export token reads
Metric Export API — the parameters of the export links
API Tokens Usage Guide — step-by-step token creation and examples
Organization Security Policy — the sign-in and 2FA rules of an organization, and what they do not affect
Account Security FAQ — common questions on sign-in, 2FA and tokens