> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Service token

> Infisical service tokens allow users to programmatically interact with Infisical.

Service tokens are authentication credentials that services can use to access designated endpoints in the Infisical API to manage project resources like secrets.
Each service token can be provisioned scoped access to select environment(s) and path(s) within them.

## Service tokens

You can manage service tokens in Access Control > Service Tokens (tab).

### Service token (current)

Service Token (ST) is the current widely-used authentication method for managing secrets.

Here's a few pointers to get you acquainted with it:

* Each service token is of the form `st.<id>.<secret>`. Send it in the `Authorization` header as `Bearer st.<id>.<secret>` when calling the Infisical API.
* ST supports expiration; it gets deleted automatically upon expiration.
* ST supports provisioning `read` and/or `write` permissions broadly applied to all accessible environment(s) and path(s).
* ST isn't editable.

## Creating a service token

To create a service token, head to Access Control > Service Tokens as shown below and press **Create token**.

![token add](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/project-token-old-add.png)

Now input any token configuration details such as which environment(s) and path(s) you'd like to provision
the token access to. Here's some guidance for each field:

* Name: A friendly name for the token.
* Scopes: The environment(s) and path(s) the token should have access to.
* Permissions: You can indicate whether or not the token should have `read/write` access to the paths.
  Also, note that Infisical supports [glob patterns](https://www.malikbrowne.com/blog/a-beginners-guide-glob-patterns/) when defining access scopes to path(s).
* Expiration: The time when this token should be rendered inactive.

![token add](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/project-token-old-permissions.png)

In the above screenshot, you can see that we're creating a token with `read` access to all subfolders at any depth
of the `/common` path within the development environment of the project; the token expires in 6 months and can be used from any IP address.

> [!NOTE]
>
> For a deeper understanding of service tokens, it's recommended to read [this
> guide](https://infisical.com/docs/internals/service-tokens.md).

**FAQ**

> [accordion] Why is the Infisical API rejecting my service token?
>
> There are a few reasons for why this might happen:
>
> * The service token has expired.
> * The service token is insufficiently permissioned to interact with the secrets in the given environment and path.
> * (If using ST V3) The service token has not been activated yet.
> * (If using ST V3) The service token is being used from an untrusted IP.

> [accordion] Can you provide examples for using glob patterns?
>
> **Important:** The `/` character acts as a path separator. A single `*` doesn't match across `/` boundaries — use `**` to match across multiple path segments.
>
> | Pattern | Matches | Does not match |
> | - | - | - |
> | `/**` | `/folder1/`, `/folder1/subfolder/`, any depth | — |
> | `/*` | `/folder1/`, `/folder2/` | `/folder1/subfolder/` |
> | `/*/*` | `/folder1/subfolder/` | `/folder1/`, `/a/b/c/` |
> | `/folder1/*` | `/folder1/subfolder1/`, `/folder1/subfolder2/` | `/folder2/subfolder/`, `/folder1/a/b/` |
> | `/services/**` | `/services/api/`, `/services/api/v1/` | `/other/api/` |
> | `/{dev,staging}/*` | `/dev/secrets/`, `/staging/config/` | `/prod/secrets/` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.