How to rotate a TrackVia auth token

Auth tokens created before April 28, 2026 will stop working on January 12, 2027. Super Admins will need to replace each older auth token by creating a new one, updating integrations, testing, and then deactivating the old token.

Why TrackVia auth tokens need to be rotated

As part of our commitment to providing the highest level of security, on April 28th, 2026 TrackVia updated the security standard it uses to issue auth tokens. Tokens created before this date use previous standard, and tokens created after this date use the updated standard. While both standards are currently accepted, we will be deprecating the previous standard on January 12, 2027. Tokens using the previous standard will no longer work after this date.

How to rotate an auth token

Before you begin:

You need Super Admin access to create and deactivate tokens
Find the tokens you need to replace. Navigate to Profile menu > My Account > API Access, then look for any active tokens created prior to April 28th, 2026.
List every place each of the identified auth tokens is used. TrackVia is unable to determine where auth tokens are being used, so this is information that you'd likely need to receive from your IT department, or other Administrators of TrackVia. Common places include Workato, Zapier, document-merge tools, microservices, or custom API integrations.

Step 1: create a new token

In TrackVia, click the profile icon in the upper-right corner.
Select My Account
Click the API Access tab
Click Create Auth Token
Name the token
In Select User, select the same API user the old token uses
In Expiration Date, select a future date
Click Create
Click the clipboard icon next to the new token to copy the token value, and store the value somewhere secure

Note: The token name, user, and expiration date can't be changed after you click Create.

Step 2: update your integrations

Workato connections that use an Auth Token

In Workato, open the TrackVia connection
Click Disconnect. Workato will keep the Authentication type, TrackVia subdomain, Account ID, and Auth token name, but will clear the API key and Auth token.
Enter the new Auth token and re-enter your API key
Click Connect

Recipes that use the connection pick up the new Auth token automatically, so you don't need to edit them.

Workato connections that use OAuth (username and password)

Workato connections to TrackVia set up with a username and password before April 28, 2026 also stop working on January 12, 2027. These connections need to be reconnected.

In Workato, open the TrackVia connection
Check when the connection was connected. If the date is before April 28, 2026, the connection needs to be reconnected
Click Disconnect. Workato will keep the Authentication type, TrackVia subdomain, Account ID, and OAuth user description.
Click Connect
Enter your TrackVia username and password
Click Authorize

Tip: TrackVia highly recommends Auth Token authentication over OAuth for Workato. Rather than reconnecting using an email address and password, please create a new api user/auth token and use that method of authentication instead. For more information on this process, please visit API Authentication and Access.

Custom integrations

Replace the old Auth Token value wherever your code reads it, such as config files, secret stores, and environment variables. If a service only reads the value when it starts, restart the service after the update. Your API Key doesn't change, so you only replace the Auth Token.

Microservices

A TrackVia Microservice that calls the TrackVia API needs an API Key and Auth Token in its code. Super Admins can download, edit, and re-upload Microservices in production and sandbox accounts.

In TrackVia, open the Microservices page.
Download the Microservice.
In the Microservice code, replace the old Auth Token with the new one.
Upload the updated .zip file to replace the existing Microservice.

Microservices uploaded to TrackVia must use Node.js 24. If the Microservice uses an older version of Node.js, update the code to Node.js 24 before you re-upload it.

Microservices in sandbox accounts use the parent account's API Key and Auth Token. Microservices aren't copied between production and sandbox accounts, so update the Microservice in each account where it's uploaded.

Power BI and Power Query

Power BI and Power Query connect to TrackVia through the Web connector, and the Auth Token is part of the connection URL. Replace the old Auth Token in the URL with the new one.

Step 3: test each integration

Test every integration that you updated before you deactivate the old token.

In Workato, open the connection and click Test Connection. A green indicator means Workato can connect to TrackVia.
For other tools, run the integration once and confirm data moves between TrackVia and the other system.
A 401 Unauthorized error means the integration still can't authenticate. Check that the full new Auth Token was copied and that the API user is active.

Step 4: deactivate the old token

In TrackVia, click the profile icon in the upper-right corner
Select My Account
Click the API Access tab
Find the old token in the Auth Tokens list
Click the gear icon next to the old token
Select Deactivate

If an integration fails right after you deactivate the old token, the old token was still in use somewhere. Reactivate the old token from the gear icon, update the missed integration with the new token, and then deactivate the old token again. After the old token is inactive, you can also delete the old token from the gear icon. Deleting a token can't be undone.

Auth token stopped working after January 12, 2027

After January 12, 2027, TrackVia rejects older Auth tokens, and any integration that still uses one fails. In Workato, the error shows in Job History.

To fix the integration, create a new token (step 1), put the new token in the integration that failed (step 2), and test the integration (step 3).

Keep your TrackVia Auth token private

TrackVia never asks you to send an Auth token. Don't share tokens by email, chat, or support ticket. If you shared a token, create a new token, update your integrations, and deactivate the shared token right away.