Application Tokens
Application tokens let an external system call the Reniway Edge API without logging in as a user. They are the authentication method for machine-to-machine access, such as an ERP that pushes values into a Webhook connector, a script that reads connector values, or an integration that manages flows.
A token carries its own set of permissions, independent of any user account.
Creating a token
Open Settings from the left menu and select the Application Tokens tab. Viewing the tab
requires the Tokens.View permission; creating and deleting tokens requires Tokens.Manage.
Press Create New Token and fill in:
| Field | Description |
|---|---|
| Name | A name that identifies where the token is used, for example ERP webhook or Grafana export. |
| Permissions | The permissions the token grants. At least one must be selected. |
The permission switches are the same set used for users:
| Permission | Purpose |
|---|---|
Connectors.View | Read connectors and their properties. |
Connectors.Manage | Create and change connectors and properties, and write property values. |
Flows.View | Read flows. |
Flows.Manage | Create and change flows. |
OpcUa.View | Read the OPC UA server configuration. |
OpcUa.Manage | Change the OPC UA server configuration. |
Users.View | Read user accounts. |
Users.Manage | Create and change user accounts. |
Tokens.View | Read application tokens. |
Tokens.Manage | Create and delete application tokens. |
Grant only what the integration needs. A webhook that pushes measurement values needs
Connectors.Manage and nothing else.
Using a token
Send the token in the X-Reniway-Token request header on every call:
curl -X PUT \
-H "X-Reniway-Token: <your application token>" \
-H "Content-Type: application/json" \
-d '{"value":"23.4"}' \
https://<reniway-host>/bridges/12/properties/34/value
A request with a valid token does not need a user session. Endpoints check the token's permissions the same way they check a user's, so a call that exceeds the token's permissions is rejected.
Not every endpoint accepts an application token. Endpoints that are meant for machine-to-machine use, such as the webhook value endpoint, do. Others require a logged-in user.
Managing existing tokens
The tab lists every token with its name and the permissions it carries. Per token you can:
- show or hide the token value with the eye button
- copy the token to the clipboard with the copy button
- delete the token with the red bin button
Tokens stay readable in the interface, so anyone with Tokens.View can retrieve the value of an
existing token.
A token's name and permissions cannot be changed after it is created. To change what a token may do, delete it and create a new one, then update the calling system with the new value.
Security
- Treat a token like a password. Anyone holding it has the permissions it carries.
- Use a separate token per integration, so you can revoke one without breaking the others.
- Deleting a token takes effect immediately: the next call with it is rejected.
- Tokens do not expire on their own. Delete tokens that are no longer in use.
- Prefer HTTPS so the token is not sent in the clear.