# Credentials

Source: https://www.pingtower.com/docs/getting-started/credentials/

Three kinds of bearer token, each with a prefix that makes it impossible to hand one where another belongs.

| Token | Prefix | Grants | Get one from |
| --- | --- | --- | --- |
| **Session** | `pts_` | The account plane: list and create tenants, manage members and keys. | `POST /v1/login`, or signing in from the app |
| **Tenant API key** | `ptk_<tenant>_` | One tenant's data plane: pull, ack, resolve, projects, sources, rules, integrations, actions, log tail. | `POST /v1/tenants/{tid}/keys`, or Account → API keys in the app |
| **Ingest source token** | `pti_<tenant>_` | `POST /v1/ingest` only. Cannot read anything back. | Creating a source |

The `<tenant>` segment is a routing hint that picks which database to open. The secret is still verified by a constant-time compare inside that database, so a forged tenant segment opens the wrong file and fails.

<div class="docs-callout crit"><svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M8 2 1.5 13.5h13L8 2Z"/><path d="M8 6.5v3M8 11.5v.5"/></svg><div><span class="t">Put the narrowest token where it runs</span>Your application servers only ever need a <code>pti_</code> token. A leaked ingest token can spam you with lines. A leaked API key can rotate every source, delete every rule, and read every log line you retain.</div>
</div>


## Shown once

The account password, every `ptk_` key and every `pti_` token are shown exactly once, at creation. There is no route that reads a secret back, only rotation. Capture each one into your secret store as it appears.

## Rotation

Source tokens rotate in place: `POST /v1/projects/{id}/sources/{name}/rotate-token` returns a new token and invalidates the old one immediately. API keys do not rotate; mint a new one, deploy it, then revoke the old one with `DELETE /v1/tenants/{tid}/keys/{kid}` or from Account → API keys. Every mint and revoke is written to the [audit log](/docs/service/team/#audit-log).

## Which token for which call

| You want to | Use |
| --- | --- |
| Send a log line or an addon measurement | `pti_` |
| Read alerts, ack, resolve, edit rules, integrations, actions | `ptk_` |
| Create a tenant, invite a teammate, mint or revoke a key | `pts_` |
| Change your own email or password | `pts_` |