For Superhuman Docs Enterprise only: View, expire, and revoke the API tokens in your org
As an Enterprise org admin, you can view every API token created by members of your org, set an expiration limit for API tokens, and revoke tokens that are no longer needed - all from your admin settings. Read on to learn how.
Availability: Token management is available to org admins on the Superhuman Docs Enterprise plan. Members’ tokens are created in their account settings. Learn how members create API tokens here.
Open the token management page
Go to docs.superhuman.com/docs
Click on your name in the lower-left corner, then select Admin settings
Scroll to - or search for - Token management (within the Security section)
The Token management page lists every API token created by members of your org. At the top of the page, summary cards show how many tokens are:
Active
Expiring soon
Expired
Revoked
Below the summary, you’ll see one row per token, including:
Token name and owner
Created: when the token was created
Last used: when the token was last used
Expires: when the token will expire, if your org has an expiration limit
Status: whether the token is Active, Expiring soon (14 days or fewer until it expires), Expired, or Revoked
Note: For security, the token itself is never shown.
Set an expiration limit for API tokens
By default, API tokens in your org never expire. To require tokens to expire, set an expiration limit:
Go to Admin settings > Token management
Under Personal access token expiration policy, set the Timeout limit
Click Save, then Confirm in the dialog that appears
If you ever need to change the limit for your org, just repeat the steps above. To remove the expiration policy, set the limit to 0 days.
Once a limit has been set...
New tokens created after you set the limit will expire after that period.
Existing tokens will also be given an expiration date based on the limit. For example, if you set a 90-day limit, a token that was created two years ago will expire 90 days after you set the limit.
Once a token expires, any apps, scripts, or services using it will lose access to the API. Requests already in progress when a token expires, however, aren’t canceled.
Members are notified by email before their tokens expire, starting 14 days out, and can regenerate their token in their account settings.
Tip: Before you set or shorten a limit, let your members know. Tokens used by scripts or integrations will stop working when they expire, so give owners time to regenerate them.
Revoke a token
If a token is no longer needed, or you suspect it’s been compromised, you can revoke it:
Go to Admin settings > Token management
Find the token, then click the three-dot menu at the end of its row
Click Revoke token
Click Revoke to confirm
The token stops working right away, and any apps or scripts using it lose access immediately. Revoked tokens stay in the list with a Revoked status.
Note: Revoking a token doesn’t remove the member from your org or affect their other tokens. To restore access, the member needs to create a new token.
Other API controls
Manage API tokens programmatically
If you prefer to manage tokens through code, you can also list and revoke your org’s API tokens using the Admin API. Token creation and revocation are also recorded in your org’s audit events.
Control how members connect to the Docs MCP
Tokens created for the Docs MCP appear on the Token management page along with other API tokens. To restrict which members can connect to the MCP using a personal access token, see Manage AI and MCP controls for your Docs org.
FAQs
Who can view and manage tokens?
Only org admins on the Superhuman Docs Enterprise plan can open the Token management page.
Can I see the token values?
No. The Token management page shows each token’s name, owner, and usage details, but never the token itself.
What’s the difference between an expired token and a revoked token?
A token expires automatically once it reaches the expiration date set by your org’s limit. A token is revoked when an admin or the token’s owner turns it off manually. Either way, apps and scripts using the token lose access.
Can members get a new token after theirs expires or is revoked?
A token can only be regenerated while it’s still active. After a token expires or is revoked, the member needs to create a new one from the API connections section of their account settings.
Will existing tokens stop working when I set an expiration limit?
Existing tokens will be given an expiration date based on your limit, and will stop working on that date. They don’t stop working immediately. For instance, if you set an expiration limit of 90 days, the countdown will start on any existing tokens, and they will expire in 90 days.
Does the expiration limit apply to MCP connections?
Personal access tokens created for the Docs MCP are API tokens, so they are included in the expiration limit. Connections made with OAuth aren’t. To control who can use each connection method, see Manage AI and MCP controls for your Docs org.