CupixWorks 5.0 — this article is still being finished. Screenshots marked to be replaced show the right screens and will be retaken before launch. Taken in a support session, so the top of the screen shows a bar you will not see. Taken on an internal test system, so the address and team name are not the ones you will see.
Two credentials, two purposes
Personal Settings › API Token holds two things that are easy to confuse. Your Personal API Token authenticates you to the CupixWorks API. The SiteView presigned URL credential generates links that let someone open a SiteView without signing in at all.
One proves who you are. The other lets you hand out access that does not need a who.
Your personal API token
The card shows the token with a Copy control and a Generate New Token button. The page carries its own warning: keep your API token secure, as it can be used to access your data in CupixWorks.
It is personal, not a team credential. Anything built on your token acts as you and reaches what you can reach. If you leave the team, whatever depends on it stops working.
Regenerating invalidates the old token immediately. One action issues a new token and kills the old one, and the confirmation says so: Regenerating will invalidate your existing token, so you will need to reset any services that use it. Anything running on the old token stops working at that moment — so reset those services as part of the same job, not afterwards.
One token, no name, no scope — and it stays readable. You get a single token; you cannot create a second one for a second purpose, cannot name them and cannot limit what one of them may reach. The value is on this page whenever you open it rather than shown once at creation. That is the intended design, not a gap, and it has one practical consequence: anyone who can open your Personal Settings can read your token, so treat an unlocked screen as a leaked credential.
The SiteView presigned URL credential
A second card, with Create credentials. Its own description: used for generating presigned SiteView URLs that allow access without login. Keep the Client Secret secure.
Read that carefully before using it. A presigned URL is access without authentication — anyone holding the link is in. That is the point of the feature and also its whole risk.
The presigned pair is separate from the API token, in both directions. Client ID and Client Secret are reissued on their own; reissuing them invalidates the previous pair the same way regenerating the API token invalidates the old token. And regenerating your API token does not touch the presigned pair — they are two credentials, not two views of one.
The Client Secret is not a one-shot value. Both the Client ID and the Client Secret can be read and copied from this page whenever you need them, so there is no moment you have to catch.
What you do have to think about is reissuing. Issuing a new pair invalidates the previous one at once, and every presigned URL you have already handed out stops working. Those links are the whole point of the credential and they are usually out in other people's hands — so reissue deliberately, and expect to reissue the links as well.