The Existing clients list shows active API clients for the workspace. Only workspace owners are able to view and edit API clients and revoke access.
Use this list to review:
- what each client is called
- what role it has
- what permissions it was granted
- whether it is still needed
If a client should no longer have access, revoke it.
Revoking access
Revoking an API client disables its token. Once revoked, the external system will no longer be able to authenticate with that token.
Use revoke when:
- an integration is no longer used
- a token may have been copied somewhere unsafe
- an employee, contractor or third-party tool no longer needs access
- you want to replace a token with a new one
After revocation, the client should disappear from the active Existing clients list.
Practical safety checklist
Before creating API access, ask:
- What system will use this token?
- What does it actually need to do?
- Can it work with Viewer access?
- Does it really need document download?
- Should submitted transactions go to pending review first?
- Who is responsible for the external tool?
If you are unsure, start with fewer permissions. You can create a new token with broader access later if needed.