# Manage API tokens and whitelisted domains

https://help.circle.so/p/sso-and-integrations/api/manage-api-tokens-and-whitelisted-domains

Category: [SSO and integrations](https://help.circle.so/p/sso-and-integrations) › [API](https://help.circle.so/p/sso-and-integrations/api)

---

_Last updated: October, 2026_

As an admin, you have full control over the management of all API tokens and whitelisted domains within your community.

## Manage API tokens

Depending on the type of API token, you can refresh or revoke it.

To access these options:

1. Click the community name or logo (or the dropdown icon next to it) in the top-left corner and select Settings.

2. Scroll down to the  **Developers**  section and select  **Tokens.**  
  

### Refresh a token

The refresh token option allows you to replace an existing API token with a new one. This is especially useful if you suspect the token has been compromised or simply need to generate a new one without going through the process of revoking and creating a new token from scratch.

The option to refresh tokens is available for Admin API v2, Headless Auth, and Zapier tokens.

To refresh a token, hover over it, click **More actions (three dots)** and select  **Refresh**. Next, click  **Confirm**  to proceed.

Once confirmed, the previous token will become invalid, and a new token will be generated. Be sure to update any services using the old token with the new one to avoid disruptions in API access.

### Revoke a token

The revoke token option makes the existing token invalid and removes it from the tokens page. Please ensure that any integrations relying on this token are updated or replaced before revoking it to avoid disruptions.

This option is available for Admin API v1 and v2 and Headless Auth tokens.

To revoke a token, hover over it, click **More actions (three dots)** and select  **Revoke**. Next, click  **Confirm**  to proceed.

## Manage whitelisted domains

For security reasons, only requests originating from whitelisted domains will be authorized to interact with the Headless Member API. You can add up to **five whitelisted domains** in your developer settings.

To add and manage domains:

1. Click the community name or logo (or the dropdown icon next to it) in the top-left corner and select Settings.

2. Scroll down to the  **Developers**  section and select  **Overview.**  

## Add a whitelisted domain

1. Click the community name or logo (or the dropdown icon next to it) in the top-left corner and select  **Settings**.

2. Scroll down to the  **Developers**  section and select  **Overview**.

3. Go to the  **Whitelisted domains**  section and click  **Add domain URL**.

4. Add your domain URL and description (this description will appear in the domain list for easy identification).

5. Click  **Add domain**.  

### Remove a whitelisted domain

1. On the overview page, go to the  **Whitelisted domains**  section.

2. Click the **Delete icon (🗑️)** next to the domain.

3. Click  **Confirm**.