API keys and tokens for push notificationsCredentials

Acciti has three kinds of credential. You send with an application token. The other two are separate so a leak exposes as little as possible.

User keyRecipient

Reaches every device you've signed in on. Give it to anyone who should be able to notify you. Rotating it stops the old key and keeps everything you've received.

If it leaks, someone can send to you. They can't read anything.

Sender tokenSender

Sends messages and does nothing else. It can't read your inbox, list your devices or remove them. Create one per script.

If it leaks, someone can send as that sender. Revoke it and your other senders keep working.

Account tokenYou

What the dashboard and the apps use to read your inbox, teams and billing. Browser sessions expire. A token made for a script lasts until you revoke it.

If it leaks, someone can act as you. Never put one in a webhook handler. Use a sender token there.

All three go in Authorization: Bearer. The server works out the kind from the token itself. A browser session expires after 30 days.