> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aftersell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Product targeting API security tokens

> Generate and manage security tokens to authenticate API requests for product targeting strategies

Security tokens allow you to authenticate API requests when accessing your product targeting strategies programmatically. You can generate, view, and regenerate tokens directly in the Aftersell admin.

## Generating a security token

To generate your first security token:

1. Navigate to **Settings → Product Strategy** in the Aftersell admin
2. Locate the **Security Token** card at the top of the page
3. Click **Generate Token**
4. Your new token will be displayed - click **Copy** to copy it to your clipboard

⚠️ **Important:** Make sure to copy your token immediately after generation. You won't be able to see it again after you leave the page.

## Viewing your token

After generating a token, you can:

* **Show/hide the token:** Click the eye icon to toggle visibility
* **Copy the token:** Click the **Copy** button to copy it to your clipboard

The token is masked by default for security. Once you navigate away from the page, the token will be permanently hidden and can only be regenerated (which invalidates the previous token).

## Regenerating a token

If you need to create a new token (for example, if your current token was compromised):

1. Navigate to **Settings → Product Strategy** in the Aftersell admin
2. In the **Security Token** card, click **Regenerate**
3. Your new token will be displayed - click **Copy** to save it

⚠️ **Warning:** Regenerating a token will immediately invalidate your previous token. Any API requests using the old token will fail. Make sure to update all systems using the old token before regenerating.

## Using your security token

Send your security token in the `X-Strategy-Api-Key` header on every Strategy API request. Keep your token private and secure - treat it like a password.

<Warning>
  Only one token can be active per store at a time. Generating a new token immediately invalidates the previous one, so a single token has to be shared by every environment that calls the API - you cannot issue separate development, staging, and production tokens.
</Warning>

💡 **Best practices:**

* Store tokens securely (never commit them to version control)
* Regenerate tokens if you suspect they've been compromised
* Update every system that uses the token before you regenerate it, since the old token stops working immediately
* Keep a record of when tokens were generated and where they're being used