Pingtower
Docs
Credentials
Three kinds of bearer token, each with a prefix that makes it impossible to hand one where another belongs.
| Token | Prefix | Grants | Get one from |
|---|---|---|---|
| Session | pts_ | The account plane: list and create tenants, manage members and keys. | POST /v1/login, or signing in from the app |
| Tenant API key | ptk_<tenant>_ | One tenant’s data plane: pull, ack, resolve, projects, sources, rules, integrations, actions, log tail. | POST /v1/tenants/{tid}/keys, or Account → API keys in the app |
| Ingest source token | pti_<tenant>_ | POST /v1/ingest only. Cannot read anything back. | Creating a source |
The <tenant> segment is a routing hint that picks which database to open. The secret is still verified by a constant-time compare inside that database, so a forged tenant segment opens the wrong file and fails.
pti_ token. A leaked ingest token can spam you with lines. A leaked API key can rotate every source, delete every rule, and read every log line you retain.Shown once
The account password, every ptk_ key and every pti_ token are shown exactly once, at creation. There is no route that reads a secret back, only rotation. Capture each one into your secret store as it appears.
Rotation
Source tokens rotate in place: POST /v1/projects/{id}/sources/{name}/rotate-token returns a new token and invalidates the old one immediately. API keys do not rotate; mint a new one, deploy it, then revoke the old one with DELETE /v1/tenants/{tid}/keys/{kid} or from Account → API keys. Every mint and revoke is written to the audit log.
Which token for which call
| You want to | Use |
|---|---|
| Send a log line or an addon measurement | pti_ |
| Read alerts, ack, resolve, edit rules, integrations, actions | ptk_ |
| Create a tenant, invite a teammate, mint or revoke a key | pts_ |
| Change your own email or password | pts_ |