Token management lets a workspace admin see every personal API token created by workspace members and revoke any of them. It is available on every plan, Free included.

The typical reason to use it: a token has leaked — pasted into a public repository, a chat or a CI log — and you need to know whose it is and revoke it now, without waiting for its owner to do it.

Overview

What the page lists: active personal API tokens of workspace members, including members who have since been deactivated (marked "deactivated", so you can clean them up). A revoked token disappears from the list.

What it does not list: app tokens and SCIM tokens. Those are managed where they were created.

The page never shows a full token value. A token is identified by its name and its last four characters.

Tokens created before Token management was released show n/a instead of the last four characters. Qase never stores a token's value, so those characters cannot be recovered for older tokens. An n/a token can still be found by its value and revoked like any other.

Opening Token management

Navigate to Workspace → Token management, in the SECURITY section of the workspace menu, or go to app.qase.io/workspace/api-tokens.

The menu item appears only for users whose role has the Token management permission. See Who can manage tokens below.

The Token management page listing tokens with their name, last four characters, owner, created date and last used date

Each row shows the token name with its last four characters, the owner's name and email, the date it was created and when it was last used (Never if it has not been). Search by token name or owner, and sort by any column.

Finding the owner of a leaked token

When all you have is the token itself, look it up by its value:

Click Find token by value.
Paste the full token and click Find.
If the token belongs to this workspace, you see its name, owner, created date and last used date.
Click Revoke this token, or Revoke all tokens of the owner to revoke every token that member has.

The Find token by value dialog showing a token found in this workspace, with Revoke this token and Revoke all tokens buttons

The value you paste is compared against stored hashes and is never stored or logged.

Token not found in this workspace means the token is unknown, already revoked, an app token, or belongs to a different workspace. Qase deliberately does not say which.

Revoking tokens from the list

To revoke one token, open the row's ⋯ menu and select Revoke. To revoke several at once, tick their rows and click the trash icon.

In the confirmation dialog you can add an optional reason, up to 500 characters. The reason is recorded in the audit log and included in the email to the token's owner.

The Revoke 2 tokens dialog with a reason entered and a warning that pipelines using these tokens will stop working

Revocation is immediate and cannot be undone. Any CI pipeline, reporter or script using the token stops working at once.

What happens after a revoke

The token's owner receives an email saying their API tokens in the workspace were revoked. It lists the revoked tokens by name and last four characters, who revoked them, when, and the reason if one was given. A member gets one email per revoke, even when several of their tokens were revoked together.

The API tokens revoked email, naming the token, who revoked it, when, and the reason

To restore access, the member creates a new token in their profile under API Tokens and replaces the old token wherever it was used — for example, in a CI secret.

Tracking tokens in the audit log

Personal API tokens have their own type in Audit Logs. Go to Workspace → Audit Logs, click Add filter, choose Type and select API tokens.

Workspace Logs filtered by Type: API tokens, showing tokens created and one token revoked with its reason

Event	Shown as the author	What the entry includes
Token created	The member who created it	Token name
Token revoked by an admin	The admin who revoked it	Token name, last four characters, owner, and the reason if given

These are not logged: a member deleting their own token from their profile, tokens created before Token management was released, and app tokens.

Who can manage tokens

Access is controlled by the Token management permission, in the Security group of the role editor (Workspace → Roles).

The Security group of the role editor with the Token management permission ticked

Role	Access by default
Owner	Yes
Administrator	Yes
Member	No
Custom roles	No — an admin adds the permission to the role

The permission is all or nothing: there is no view-only level. Anyone who can see the page can revoke any member's tokens, including the Owner's, so that a leaked token can always be revoked no matter whose it is.

See Roles & Permissions for how to create and edit roles.

FAQ

I can't see Token management in the workspace menu. Your role does not have the Token management permission. Ask your workspace Owner or an Administrator to add it. Your plan does not matter.

Can a revoked token be restored? No. The member creates a new token and updates everywhere the old one was used.

Can an admin see a member's full token? No. Only its name and last four characters.

The lookup says the token was not found, but the token still works. The token most likely belongs to another workspace, or it is an app token. Check it from the workspace it was created in.

Our CI stopped working after a revoke. This is expected. The token's owner creates a new token in their profile and updates the CI secret with it.

I see "Too many lookups". Lookups by value are limited to 10 per minute and 60 per hour per user. Wait and try again.