id,page,ref,title,content,breadcrumbs,references
authentication:createtokenview,authentication,createtokenview,API Tokens,"Datasette includes a default mechanism for generating API tokens that can be used to authenticate requests. 
             Authenticated users can create new API tokens using a form on the  /-/create-token  page. 
             Tokens created in this way can be further restricted to only allow access to specific actions, or to limit those actions to specific databases, tables or queries. 
             Created tokens can then be passed in the  Authorization: Bearer $token  header of HTTP requests to Datasette. 
             A token created by a user will include that user's  ""id""  in the token payload, so any permissions granted to that user based on their ID can be made available to the token as well. 
             When one of these a token accompanies a request, the actor for that request will have the following shape: 
             {
    ""id"": ""user_id"",
    ""token"": ""dstok"",
    ""token_expires"": 1667717426
} 
             The  ""id""  field duplicates the ID of the actor who first created the token. 
             The  ""token""  field identifies that this actor was authenticated using a Datasette signed token ( dstok ). 
             The  ""token_expires""  field, if present, indicates that the token will expire after that integer timestamp. 
             The  /-/create-token  page cannot be accessed by actors that are authenticated with a  ""token"": ""some-value""  property. This is to prevent API tokens from being used to create more tokens. 
             Datasette plugins that implement their own form of API token authentication should follow this convention. 
             You can disable the signed token feature entirely using the  allow_signed_tokens  setting.","[""Authentication and permissions""]",[]