Skip to main content

Staffbase API token

Staffbase knows your widgets only once they are registered. Usually this happens in the browser with your Staffbase login as soon as you change something in Widget Builder.

Changes without a browser session are left behind: through the MCP server, in the AI assistant or by JASP. With a stored Staffbase API token, Widget Builder registers them itself. The token is optional; without it, click "Re-register Widgets" on the dashboard after such changes.

Create the token​

  1. In Staffbase Studio, open Settings → API Access.
  2. Create a token with the access level Administrative.
  3. If possible, limit it to the IP addresses of Widget Builder.
  4. Copy the token.

So far only the level "Administrative" has been tested. Such a token can also read users, groups, spaces, pages and posts of your instance. Widget Builder uses it only to register your widgets.

Store the token​

  1. In Widget Builder, open Settings → Technical / IT → Staffbase API token → Manage token.
  2. Paste the token and click Save token.

Widget Builder checks the token against your Staffbase instance right away. If Staffbase rejects it or it belongs to another instance, nothing is stored. The token is stored encrypted; afterwards the page shows only its first 7 characters and, under Status, whether Staffbase last accepted it.

If the Staffbase address of your account changes, Widget Builder deletes the token automatically.

What Widget Builder does with the token​

Under Usage you decide what the token is used for:

SwitchEffect
After changes through the MCP serverRegistration after creating, changing, deleting and importing through MCP tools
After changes in the AI assistantRegistration when the AI assistant creates, changes or deletes a widget
After changes to built-in widgetsRegistration after JASP activates built-in widgets and after a license change
Search in pickersSearch for groups, users, channels, pages and spaces (see below)

Widget Builder only updates an existing registration. Do the first registration once on the dashboard with your Staffbase login.

Widget Builder also uses the token to search for groups, users, channels, pages and spaces when you search in permissions, data table sharing or settings fields. The answer holds only id, name and profile picture. Without a token, or with Search in pickers switched off, the search uses your own Staffbase login. Searches are not logged.

Data sources, API connections and widget layouts never receive the token.

Log​

The Log lists every registration and every change of the token in the last 90 days: time, trigger, result and the Staffbase response. For changes in the settings it shows the person's name. Status reads and the token itself are not logged.

When something goes wrong​

  • "Staffbase rejects the stored token": the token was deleted in Staffbase Studio or lost its rights. Store a new one.
  • "Not registered yet": register the widgets once on the dashboard with your Staffbase login.
  • Token no longer readable: after changing the BACKUP_ENCRYPTION_KEY (Standalone), Widget Builder can no longer decrypt stored tokens. Store the token again.