API tokens let an application read or control selected Uptime Basics resources without using your email, password, browser session, or authenticator code. Each token belongs only to your customer account.
Create a token
- Sign in to Uptime Basics.
- Open Account > Integrations.
- Select Create API token.
- Enter a name that identifies the application or environment.
- Choose an expiration period.
- Select only the permissions the application needs.
- Choose whether the token can access all monitors or only selected monitors.
- Create the token and copy it immediately.
For security, token creation requires a recent sign-in. If the page asks you to authenticate again, sign out, sign back in, and repeat the action.
The complete token begins with ub_live_ and is shown only once. Uptime Basics stores a one-way hash rather than the original token, so support cannot recover it later.
Limit access to selected monitors
Choose Selected monitors only when an application does not need access to the whole account. Search the monitor list, select only the required monitors, and create the token.
A selected-monitor token:
- cannot list or read other monitors;
- receives a not-found response for an unapproved monitor;
- does not automatically gain access to monitors created later; and
- loses access to a selected monitor when that monitor is deleted.
Choose All current and future monitors only when the connected application genuinely needs account-wide monitor access.
Store and send it safely
Store the token in a server-side secret manager or protected environment variable. Do not place it in:
- browser JavaScript;
- a mobile application package;
- source control;
- a public support message;
- a URL or query string; or
- a public status page.
Send it in the HTTPS Authorization header:
Authorization: Bearer ub_live_key-id.secret
The API base URL is:
https://api.uptimebasics.com/v1
Choose an expiration
Available expiration periods are 30, 90, 180, or 365 days. A shorter lifetime limits exposure if a token is copied or forgotten. Create separate tokens for separate applications instead of reusing one token everywhere.
Token limits depend on the account plan:
| Account state | Active tokens |
|---|---|
| Trial | 1 |
| Starter | 1 |
| Plus | 3 |
| Pro | 5 |
Rotate or revoke a token
Use Rotate when an application still needs access but its credential should be replaced. Rotation immediately revokes the existing token and displays a replacement once. Update the connected application right away. The replacement keeps the same permissions and monitor restrictions and expires after 90 days.
Open Account > Integrations, find the token, and select Revoke. Revocation is saved immediately. Because successful authorization decisions are cached for up to 60 seconds, a request using that token can still be accepted during that short window and an already authorized request may finish. A revoked or expired token cannot be restored; create a replacement and update the application instead.
Uptime Basics records safe token lifecycle metadata such as its name, prefix, scopes, monitor-access mode, creation, rotation, expiration, revocation, and last-use times. The complete secret is never returned.