Primary and secondary tokens

Keepit uses two kinds of tokens:

• Primary token — a user's identity in Keepit. Every user has exactly one primary token, created when the user is created. An account can hold several users, and therefore several primary tokens. A primary token is always the root of its own token tree and is never a child of another token.
• Secondary token — a credential created under an existing token, for example a browser session token or a dedicated API token. A secondary token authenticates requests on behalf of the user, but the platform records and displays the activity under the primary token's identity.

For how to authenticate API requests with a token, see Authentication. For creating and managing tokens through the API, see the Tokens section of the Accounts API.

Operations that require a primary token

Some operations accept only primary token credentials. For example, changing the multi-factor authentication (MFA) configuration requires the primary token; a request authenticated with a secondary token is rejected.

The primary token represents the user

Throughout the platform, activity and ownership are shown under the primary token's identity — even when the action was performed with a secondary token:

• Connector and device access lists. The list of users who have access to a connector (orglink) or device shows primary tokens only.
• Audit logs. Entries record the primary token's email address in the User column, and the user filter offers primary token identities only.
• Secure shares. The Created by column shows the primary token's email address, regardless of which token created the share.
• System messages. Notification emails — such as backup completion notices — are addressed to the primary token's name and sent to its contact address.
• Account users. The Account info → Users screen lists the account's users; each row corresponds to a primary token. Secondary tokens do not appear as separate entries.
• Scheduled reports. Reports are scheduled on behalf of the primary token, independent of which token created the schedule.

Managing the user and their tokens

The User info screen displays and manages the primary token's details: full name, email address, password, and user role. Changes to any of these fields — including the password — affect the primary token.

The user's secondary tokens are managed separately on the Security → Secondary tokens screen, accessible from User info. It lists all active secondary tokens issued under the primary token, with their names, activation dates, lifetimes, and expiration dates, and is where API tokens are added or removed.