API Token

An API Token is the credential for ExpTech APIs that require authentication. It starts with et_. You create a token on the dashboard. It does not expire until you revoke it. Most of the public HTTP data APIs do not need a token. The Authentication section on each endpoint’s page says whether that endpoint needs one.

Create a token

1. Sign in at https://manager.exptech.com.tw/login (enter your email, then open the sign-in link in the message).
2. Open the API Tokens page on the dashboard.
3. Choose the permissions this token needs. You can add a note (15 characters at most).
4. After you create it, the page shows the full token. The token is shown only once. Save it somewhere safe immediately. Later, the list shows the note and the permissions, not the token itself.

Note

• Each account can have at most 25 tokens. Tokens issued to a third-party app through OAuth2 count toward that limit. Delete tokens you do not use before you create more.
• Permissions are fixed when you create the token. To change them, create a new token and revoke the old one.

Token format and lifetime

• Format: et_ followed by 43 base64url characters (A–Z, a–z, 0–9, -, _). Example: et_3q2-7wAAexampleexampleexampleexampleexample.
• Lifetime: no expiry, and no refresh token. It stays valid until it is revoked.
• The server stores only a hash of the token. A lost token cannot be recovered. Create a new one.

How to send the token

Each transport reads the token from a different place. A token in the wrong place is treated as missing.

Use	Where to send it	Notes
HTTP API (endpoints marked as requiring a token)	header X-Api-Token: <token>	This header is the only place that is read. A token in the query string or in Authorization gets a 401
SSE real-time stream	header Authorization: Bearer <token>, or query token=<token>	When both are present, the header wins. Bearer is case-sensitive, and one space follows it
OAuth2 user info	header Authorization: Bearer <token>

HTTP

GET /api/... HTTP/1.1
X-Api-Token: et_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

SSE streams

Clients that can set headers (a server, an app, or curl) should use the header:

curl -N -H "Authorization: Bearer et_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  "https://api.lb.exptech.dev/api/v1/trem/sse/report"

The browser EventSource cannot set headers, so the token has to go in the query string:

const token = "et_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
const es = new EventSource(
  `https://api.lb.exptech.dev/api/v1/trem/sse/report?token=${encodeURIComponent(token)}`,
);

Token in the URL

A token in the query string shows up in the URL, browser history, proxies, and logs. Code in a web page is also visible to the user. Do not put your own token in a public web page. To connect on a user’s behalf, use OAuth2 and get that user’s own token.

Some stream topics are public. You can connect without a token. If you do send a token, usage is counted on that account. An invalid or revoked token rejects the whole connection (HTTP 401, body invalid token), including public topics. A topic that requires a permission needs a token with that permission, and the account must already be subscribed to that resource. See real-time streams for each topic’s rules.

Revoke a token

Delete it on the API Tokens page of the dashboard. There is no API that revokes a token by presenting the token itself.

• HTTP: the token is fully invalid within about 1 minute.
• SSE: about 5 seconds after revocation, every stream connection authenticated with a token on that account receives event: close and data: token revoked, then closes. This includes connections that used a different token. Reconnect with another token that is still valid.

Security recommendations

• Do not put a token in frontend code, an app package, or a public Git repository.
• Use one token per purpose, and write the note so it says where that token is used. If it leaks, revoke that one token.
• Grant only the permissions you need. * (all permissions) is convenient for testing, and a leak of that token has the widest impact.

Related pages

Permissionspermission names and groups

Usage and quotahow the daily count works, and how 403 differs from 429

Error codesstatus codes and why a stream disconnects

OAuth2let a third-party app get a user's authorization