#Overview

Navigate to Project settings to find your Project API access settings with endpoints, content API permissions, and permanent auth tokens.

#Endpoints

This section contains the URL endpoints of your environments.

API Access - Endpoints

Simply click on the URL you want to copy. A message will pop up on the lower right corner of your screen, letting you know the URL has been copied to clipboard.

#Content API

Here you can configure Content API access permissions for unauthenticated requests.

API Access - Content API

#Default stage for public content delivery

This section shows the default stage for public content delivery. If no stage parameter is set on the GraphQL query or additional HTTP header, then content from the selected default stage will be served. You can learn more about this in our Default public stage documentation.

To change the default change, click on Change default stage next to the stage tag, select one of the available stages, then click on Change to save.

#Content permissions

On this screen section you can view, edit, and delete existing content permissions, as well as add new ones.

API Access - Content permissions

Our document on Permissions contains more information on how they work.

#Sort permissions

Use the Sort by dropdown menu at the top of the permissions table to sort models and actions. You can choose to sort them in ascending or descending alphabetical order.

API Access - Sort permissions

#Filter permissions

Click on + Filter permissions to access the following options:

#Add permissions

To add a permission please click on + Add permission at the top right of the permissions table, then follow the Add content permissions flow.

#Edit permissions

If a permission can be edited, you will find this option in the context menu to the left of the permissions table.

API Access - Edit permissions

A popup will give you the option to update the permission by selecting a different locale or stage.

#Delete permissions

Find the option to delete a permission in the context menu to the left of the permissions table.

API Access - Delete permissions

As deletions are permanent actions that can't be rolled back, a popup will display informing you of this and you will need to confirm the deletion by clicking on Delete.

#Permanent Auth Tokens

Here you can configure tokens for permanent authorization for the content and management API.

API Access - Permanent Auth Tokens

Permanent Auth Tokens (PATs) are used for controlling access to querying, mutating content, and come in the form of Bearer token authentication.

The list displays all existing tokens related to your project. To copy a token, click on the copy icon at the right of the existing tokens table.

Access our documentation on Authorization to learn more about permanent auth tokens.

#Add tokens

To add a token, click + Add token at the top of the tokens table:

Write a name for your token and, optionally a description. Use the radio buttons to select a default stage for content delivery, then click on Add & configure permissions to continue.

Your token details screen will display:

API Access - Token details screen

On this screen, you can:

• Configure content API access: You can initialize default permissions or create your own custom ones. You can also check out this document section.
• Configure Management API permissions: You can use the buttons to initialize defaults or create custom permissions.

#Content permissions

When you create a PAT, default content permissions are activated. You can configure content API access:

• The default stage for content delivery is PUBLISHED. To change this, click Change default stage and select a different stage from the ones configured in your project.
• Default content permissions grant Read access on all Models for all Locales. To edit this, click +Add permission.

#Management API Permissions

To edit Management API Permissions, use the switches. By default, the screen shows only the permissions that are enabled, to see the full list click on Show all permissions at the top of the form.

• Basic permissions are selected by default, as they are necessary for the user to view the UI correctly. You can edit this - if needed - and select other permissions as well.
• If you use the checkboxes to select more than one of the enabled permissions, the Disable selected bulk action appears at the top of the table.
• If you use the checkboxes to select more than one of the disabled permissions, the Enable selected bulk action appears at the top of the table.
• The Show all permissions link at the top of the table displays all permissions, enabled and disabled. After clicking on it, the link at the top of the table will say Show enabled permissions, and clicking on it returns you to the view where only enabled permissions are visible.

#Edit tokens

Access the edit view of a token by clicking on it on the table, or by selecting the Edit option in the context menu.

API Access - Edit token

The token details screen will display, where you can add new permissions associated to the token or edit existing ones, as shown in the previous document section.

#Delete tokens

Delete a token by selecting the Delete option in the context menu.

API Access - Delete token

You can also find this option inside the token details view you access when editing.

API Access - Delete token

Since deleting a token is a permanent action that cannot be rolled back, a popup will display notifying you of this, and you will have to click on Delete <token_name> to complete the process.

#Can’t find your token in Hygraph?

If you copied a PAT a while ago and can’t find the same token string in Hygraph today, the token may still be active even if it looks different.

Hygraph uses JWTs (JSON Web Tokens) for Permanent Auth Tokens (PATs). In cases such as audience updates or issuer migrations, the encoded JWT string may change while still representing the same underlying token. Even after such changes, the token remains valid as long as the jti (JWT ID) claim within the token's payload remains unchanged. The jti claim serves as the authoritative identifier for the token.

To verify whether two tokens refer to the same underlying token, follow these steps:

1. Go to https://jwt.io and paste the token that you want to check. This token is no longer visible in Hygraph Studio.
2. Decode the token and locate the jti claim in the payload.
3. In Hygraph Studio, go to Project settings > Access > Permanent Auth Tokens and check the jti values for the tokens listed there.
4. Compare the jti values. If the jti value found in Step 2 matches with the jti of a token available in Hygraph Studio, it is the same underlying Permanent Auth Token, even if the encoded JWT differs. The token is still active and has not been revoked. You can then decide whether to keep it or revoke it.
   • If you want to keep the token, you can replace the deleted JWT with the one that matches from Hygraph Studio.
   • If you want to revoke the token, you can delete it from Hygraph Studio. This action invalidates all JWTs associated with that token, including any previously issued ones.

Permanent Auth Tokens list

#Resources

You might find the following documents useful:

• Permissions: This document contains information on permissions, how they work, and their limits.
• Roles and permissions: This document contains information on how to work with roles and permissions in the Hygraph app.
• Authorization: This document contains information on public API permissions, permanent auth tokens, and API endpoints.