Guide

Tokens

Two environments, one active token each, and how to keep them safe.

Test and live

Every bot holds two tokens, one per environment: sxb_test_… and sxb_live_…. The environment is baked into the token, and the API refuses cross-environment writes: a test token can never touch a live chat, and a live token can never touch a test chat. Only one token is active per environment at a time.

Storage rules

• Keep tokens in environment variables or a secrets manager. Never in git, never in client-side code, never in logs.
• The live token only ever belongs on your server. If your bot has no server (pure polling from a laptop), that is what the test token is for.
• Treat a leaked token like a leaked password: rotate first, investigate second.

Rotation

Rotate a token any time from the bot's page in the dashboard (Tokens tab), or with regenerateToken. Rotation is immediate: the old token stops working the moment the new one is issued, so deploy the new token to your server first, then rotate, or expect a brief outage.

curl https://api.sprintelex.com/regenerateToken \
  -H "Authorization: Bearer <owner-dashboard-session>" \
  -H "Content-Type: application/json" \
  -d '{"bot_id": "<bot-id>", "env": "live"}'

When tokens die on their own

Deleting a bot revokes both tokens instantly. A suspended bot's tokens return 403 until the suspension is lifted. Neither case sends you a notification, so if your bot suddenly gets 401s on every call, check the dashboard before assuming a bug in your code.