GUIDES · SECURE
Scoped tokens, rotated quarterly.
A token is a key to your security platform, so treat it like one. Scope each token to the surface it actually needs, rotate on a schedule, and a leak becomes small and short-lived instead of a standing risk.
Scope to the surface
Never hand a service a workspace-admin token. Issue a token scoped to exactly the verbs and surfaces it uses — a tailing job reads events and nothing else.
SHELLissue a scoped token $ td token create --name ci-detections \ --scopes detections:write,events:read \ --expires 90d ok tds_live_xxxx (shown once) . scopes: detections:write, events:read
| Use | Scopes |
|---|---|
| Event tailing / SIEM export | events:read |
| Detection CI | detections:write · events:read |
| Automated response | contain:write · cases:write |
Rotate on a schedule
Rotation runs a dual-token window: the new token is valid before the old one dies, so there is no flag-day. Automate it and quarterly rotation costs nothing.
SHELLrotate $ td token rotate tok_4kQ --overlap 24h -> new secret issued . both valid for 24h ok roll consumers, then: td token rotate --finalize tok_4kQ
Revoke fast
A leaked token is a one-command problem. Revoke it, then read its recent usage to scope the blast radius.
Revocation is immediate and irreversible.
td token revoke kills the credential the moment it returns — any service still using it starts failing at once. Confirm the consumer has the new token before you revoke the old, or pair the revoke with a planned cutover.Where to go next
- SDKs — tokens in the client libraries.
- Webhook security — sign and verify deliveries.