# Ensure Utho API Tokens are rotated periodically (e.g., every 90 days)

- Source: https://support.icompaas.com/support/solutions/articles/a_1786022440973383-ensure-utho-api-tokens-are-rotated-periodically-eg-every-90-days
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Utho Cloud](https://support.icompaas.com/support/solutions/c_1786022244474917) › [Utho Checks](https://support.icompaas.com/support/solutions/folders/utho-checks)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Utho API Tokens are used to authenticate applications, automation tools, and scripts that access Utho services through the REST API. Regularly rotating API tokens reduces the risk of unauthorized access by limiting the lifetime of exposed credentials. Organizations should rotate API tokens periodically, such as every 90 days, as part of their credential management policy.

  

Rationale:

Regularly rotating API tokens minimizes the impact of compromised or exposed credentials. Even if an API token is leaked, its usefulness is limited to the rotation period. Token rotation is a security best practice and helps organizations meet compliance requirements such as SOC 2, ISO/IEC 27001, and other security standards.

  

Impact:

-   Applications, scripts, and integrations using the existing API token must be updated after a new token is generated.
    
-   Failure to update dependent applications may result in authentication failures.
    
-   Administrators should plan token rotation carefully to avoid service interruptions.
    

  

Default Value:

By default, Utho does not automatically rotate API tokens. API token rotation must be performed manually according to the organization's security policy.

  

Pre-requisites:

-   A Utho account with permissions to manage API tokens.
    
-   Existing Utho API tokens.
    
-   Access to all applications, scripts, or automation tools that use the API tokens.
    
-   A documented API token rotation policy.
    

  

Remediation

Test Plan:

1.  Sign in to the Utho Console using an account with appropriate permissions.
    
2.  Navigate to Account → API Token.
    
3.  Review all existing API tokens.
    
4.  Verify the creation date or last rotation date for each API token.
    
5.  Confirm that no active API token is older than 90 days.
    
6.  Verify that unused or inactive API tokens have been removed.
    

7.  If any API token is older than 90 days, unused, or does not comply with the organization's API token rotation policy, follow the Implementation Steps to remediate the issue.
    

Using the Utho API

Audit the API token by sending an authenticated request to the Utho REST API.

  

curl -s -H "Authorization: Bearer $UTHO\_API\_TOKEN" \\

https://api.utho.com/v2/cloud

  

  

Verify that the API request returns a successful response.

  

### Implementation Steps

1.  Sign in to the Utho Console with administrative privileges.
    
2.  Navigate to Account → API Token.
    

3.  Click Add New API Token.
    

4.  Enter a meaningful API Name.
    
5.  By default, the API token is created with Read access.
    
6.  If the application or integration requires permission to create, update, or delete resources, enable the Write access option.
    
7.  Click Add New API to generate the new API token.
    

8.  Copy and securely store the newly generated API token, as it is displayed only once.
    
9.  Update all applications, scripts, and integrations to use the new API token.
    
10.  Verify that all applications are functioning correctly with the new API token.
     
11.  Delete  the old API token.
     

Using the Utho API

Verify that the newly generated API token can successfully authenticate to the Utho REST API.

  

curl -s -H "Authorization: Bearer $NEW\_UTHO\_API\_TOKEN" \\

https://api.utho.com/v2/cloud

  

Verify that the API request returns a successful response before updating production applications to use the new API token.

  

Backout Plan:

1.  Sign in to the Utho Console with appropriate permissions.
    
2.  Navigate to Account → API Token.
    
3.  If the previous API token is still active, configure the affected applications or scripts to use the previous API token.
    
4.  Verify that all applications and integrations are functioning correctly.
    
5.  Delete the newly generated API token if it is no longer required.
    

Note: If the previous API token has already been revoked or deleted, the rollback cannot be performed. In this case, generate a new API token and update all dependent applications.

  

References:

-   [Utho Documentation](https://utho.com/docs/)
    
-   [Utho API Documentation](https://utho.com/rest-api/)
    
-   [Utho API Overview](https://utho.com/api/)
    
-   [Generate API Token](https://utho.com/docs/products/account/api-token/how-tos/how-to-generate-api-token/)
    
-   [Delete API Token](https://utho.com/docs/products/account/api-token/how-tos/how-to-delete-api-token/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.