Authentication
Oktivo uses two authentication methods depending on the context:
API Tokens
API tokens are designed for server-to-server integrations. They authenticate requests to the CRM API endpoints (/api/v1/crm/calls/*).
All API tokens use the okt_ prefix followed by a random string:
The prefix makes tokens easy to identify in logs and secret scanners.
Creating a Token
From the dashboard: open Settings → API Tokens (app.oktivo.com/account),
click Create Token, name it, and pick an expiry. The panel lists each token
with its expiry and last-used date, and lets you rotate (↻) or delete (🗑) it.
Each account can hold a maximum of 5 active tokens — delete an unused one to
free a slot.
Via the API:
The plaintext token is returned exactly once in the response. Store it securely you cannot retrieve it again.
Token Expiry
Tokens expire after the configured expiresInDays (1–365 days). Expired tokens are automatically rejected. Plan to rotate tokens before they expire to avoid service interruptions.
Token Rotation
Rotate a token to invalidate the old value and get a new one in a single operation:
This returns a new plaintext token. The old token stops working immediately.
Using API Tokens
Include the token in the Authorization header for all CRM API requests:
Token Limits
- Maximum name length: 128 characters
- Expiry range: 1–365 days
- Tokens can be soft-deleted (they stop working immediately but records are retained)
JWT Authentication
JWT tokens are issued when users log in through the Oktivo dashboard. They authenticate:
- Token management endpoints (
/api/v1/crm/tokens/*)
- Webhook management endpoints (
/webhooks/endpoints/*)
- Dashboard API calls
JWTs are managed automatically by the dashboard you don’t need to handle them for CRM integrations.
Which Should I Use?
- Building a CRM integration? → Use an API token
- Managing tokens or webhooks programmatically? → Use JWT from an authenticated session
- Using the dashboard? → JWT is handled automatically
