Tokens and access
A token opens one database, from anywhere. Owners and admins show tokens and rotate them; every token shown is written to the workspace audit log.
Show a token
- Open the databaseIn the AOZUMI DB console, open a standalone database.
- Choose what it may doRead and write or Read only.
- Select Show tokenCopy the token, or both
.envlines. Hide removes it from the page.
Tokens start with adb1. and open one database only. They have no expiry. Each token shown is recorded in the workspace audit log with its access level, never the token itself.
Read only or read and write
A Read only token can run any query, and every write fails with SQLITE_READONLY. Use it for dashboards, reports and anyone who only needs to look. Apps get a read-and-write token.
Rotate to revoke
Select Rotate token on the database's page. Every token shown before stops working at once, read-only ones too: their next request gets 401. Select Show token again for the new one.
If the database is handed to an app, the running app's token stops working too. AOZUMI sets the new one on the app; redeploy it right away. See Rotate an app's token.
Tokens of app databases
The AOZUMI DB console does not show the token of a database an app owns. AOZUMI keeps it in the app's environment as AOZUMI_DB_TOKEN. Rotate a Production database's token from the app's Settings › Databases, then redeploy.
API keys
Coding agents, scripts and CI reach AOZUMI DB with an API key from your Profile, under Deploy from Cursor or Claude. See AOZUMI DB from a coding agent.
| Key access | What it can do with databases |
|---|---|
| Read or Deploy | List databases, read schemas, run read-only SQL. |
| Manage, held by an owner or admin | Also create and delete databases, show and rotate tokens, and run SQL that writes. |
- Keys from
aozumi loginand Hachi sign-in, and keys made before access levels existed, are refused. - Each key can make 60 database requests a minute; over that it gets
429withRetry-After. Apps connect with a token instead, which this limit does not touch. - Handing a database to an app, the table browser and access requests need a signed-in person in the console.
Questions
- Do AOZUMI DB tokens expire?
- No. A token works until someone rotates the database's token. Rotating stops every token shown before it, read-only ones too.
- Why do I get the same token each time I select Show token?
- A token belongs to the database's current generation. Until someone rotates, showing it again gives you the same one, so there is no one-time reveal to lose.
- Can I give a teammate read-only access?
- Yes. Show a Read only token and share that. It can run any query, but every write fails with SQLITE_READONLY.
Checked against the product on .