I lost my API token. Can I see it again?

Why this happens

A token is a password for machines. The API Reference says the raw secret comes back once, when a token is created or regenerated. After that, Cyberlop cannot show it again. The same rule covers every secret in the product: Cyberlop encrypts it and never displays it after saving.

How to fix it

1. Ask an admin for help. Only a user with the user:manage permission can issue tokens, and they do it in Administration, under Users.
2. Ask them to create or regenerate a token for your account. The new raw secret comes back at once.
3. Copy the new value straight away and store it in your password manager or CI secret store, because the page will not show it a second time, whatever you do.
4. Replace CYBERLOP_API_TOKEN in your repository or CI variables with the new value.
5. Suspect a leak? Ask the admin to revoke the user's tokens too, using these steps to revoke API tokens.

The Administration screens were not part of the pages we reviewed, so the exact button names may differ from the words above.

Still not working?

• A new token that fails points at the pipeline secrets. See which secrets to add.
• A call that is refused points at a permission. Read why an API call returns a permission error.
• Learn how to get a personal API token in the first place.

Treat each token like a password, which means you never paste it into a chat or commit it to a repository where other people could read it. Need a hand? Use the contact page.

Related questions

• How do I get a personal API token?
• How do I revoke a user's API tokens?
• My API token suddenly stopped working. Why?
• Which secrets do I need to add to my repository for CI scans?
• Why can't I see my saved token or key any more?

Full tutorial

Cyberlop API tokens and permissions: how to issue and limit them

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre