API tokens

This page is for a workspace Admin who needs a credential for automation. An API token lets a CI job, an MCP client, or a script act in one workspace with only the permissions you choose.

On GitHub Actions you usually do not need a token. See Run Veriom in CI for keyless sign-in.

Before you startCopy Anchor Link

• You have the Admin or Owner role.
• You are signed in to Veriom in your browser. Tokens cannot create other tokens.
• Your plan has a free token slot. The Free Trial allows 5 tokens. See Plans and billing.

Create a tokenCopy Anchor Link

1. Open Settings and select API tokens.
2. Click Create token.
3. Enter a Name that says where the token is used, for example Production CI.
4. Choose Permissions. Pick only what the integration needs:
   • the default set reads audits, findings, reports, repositories, and usage, and can start audits;
   • Use MCP preset picks audits:write, evidence:write, ingestion:read, and uploads:write for an MCP client.
5. Choose when it Expires. The default is 90 days and the longest is 366 days.
6. Click Create token and confirm your identity if Veriom asks.
7. Copy the token. This secret is shown once. Store it in your secret manager.

Tokens start with vat_.

Test the tokenCopy Anchor Link

Send the token in the Authorization header:

curl -s https://api.veriom.ai/v1/api-tokens/current \
  -H "Authorization: Bearer $VERIOM_API_TOKEN"

A working token returns its workspace and permissions:

{
  "id": "0b8e6f1c-3d2a-4b5e-9f71-6a2c8d4e1b07",
  "name": "Production CI",
  "token_prefix": "vat_3kF9a2Lq",
  "workspace_id": "7f3c9a52-1b4e-4d8a-9c61-2e5f0a7b8d13",
  "workspace_slug": "customer-platform",
  "workspace_name": "Customer platform",
  "scopes": ["audits:read", "audits:write", "findings:read", "reports:read", "repositories:read", "usage:read"],
  "created_at": "2026-11-03T09:00:00Z",
  "expires_at": "2027-02-01T23:59:59Z",
  "last_used_at": "2026-11-03T09:01:12Z"
}

A missing, expired, or revoked token returns 401.

To try any other endpoint with your token, open the API reference: each endpoint has a playground that sends the request from your browser.

How a token actsCopy Anchor Link

• A token belongs to one workspace.
• It acts as the person who created it, and never with more than that person's current role allows. If that person leaves the workspace, the token stops working.
• The workspace access policy network list applies to tokens.
• Veriom emails the person who created a token 7 days and 1 day before it expires.

Rotate, deactivate, or revoke a tokenCopy Anchor Link

Open Settings → API tokens and choose the token:

Each action asks you to confirm your identity.

If something goes wrongCopy Anchor Link