Skip to content
Spawnbase Docs

Token handling

An API token authenticates as your whole team within its scopes. Rules:

  • Server-side only. Never in a client script, NUI page, or anything a player can download. For client uploads, mint a presigned URL — that’s what it’s for.
  • Least scope. Create separate tokens per job: a Media token for uploads, a Logs token for log shipping, an images-only token for reports-pro. A leaked logs token can’t delete files.
  • Shown once, stored hashed. We store only a SHA-256 hash; if you lose the plaintext, create a new token — we can’t show it again.
  • In FiveM, keys live in server.cfg convars — never in resource files you might share or sell.
  • Don’t share tokens between servers you don’t fully control, and never paste one into a public repo, ticket or screenshot.

Leaked? Revoke first (dashboard → Tokens — revocation is immediate), then create a replacement and update your configs. Check the file list and usage for anything you don’t recognise.