> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Workato with API Client Token – StackOne Hub

> Link a Workato account in the StackOne Hub using API Client Token. End-user guide to authorize the integration and start using Workato actions.

> [!WARNING]
>
> The Workato Developer API is included in specific pricing plans, so check your plan and contract. To create an API client, sign in with the root email address of the workspace, or as an Environment admin, a legacy Admin, or a collaborator whose custom role has the Client & access profiles privilege.

## Find your data center

The **Data center** identifies the region where your Workato workspace runs. A token works only against the data center that holds the workspace.

<ul>
  <li>Sign in to Workato and read the address in the address bar.</li>
  <li>`app.workato.com`: choose **US**</li>
  <li>`app.eu.workato.com`: choose **EU**</li>
  <li>`app.jp.workato.com`: choose **JP**</li>
  <li>`app.sg.workato.com`: choose **SG**</li>
  <li>`app.au.workato.com`: choose **AU**</li>
  <li>`app.il.workato.com`: choose **IL**</li>
  <li>`app.uk.workato.com`: choose **UK**</li>
  <li>`app.kr.workato.com`: choose **KR**</li>
  <li>`app.workatoapp.cn`: choose **CN**</li>
  <li>`app.trial.workato.com`: choose **Self-service**, used by Workato Free, Workato Pro and Developer Sandbox workspaces</li>
  <li>Virtual Private Workato workspaces use their own address and have no option here.</li>
  <li>Select the matching option in the **Data center** field in StackOne Hub.</li>
</ul>

## Create a client role

The client role lists the API endpoints the token may call. Read endpoints cover every read; the two write endpoints in the last item are optional.

**1. Sign in to Workato**

Sign in to your Workato account at the address of your data center, for example\
[Workato US](https://app.workato.com/users/sign_in) or\
[Workato EU](https://app.eu.workato.com/users/sign_in), as a user who can create API clients.

<ul>
  <li>Navigate to **Workspace admin** > **API clients** > **Client roles**.</li>
  <li>Select **Add client role**.</li>
</ul>

**2. Name the role and choose the endpoints**

Enter a name such as `StackOne Integration`, then tick the endpoints below under their sections.

<ul>
  <li>Tick **Get collaborators** `GET /api/members` to list collaborators. The connection test uses it too.</li>
  <li>Tick `GET /api/members/:id` to read a single collaborator.</li>
  <li>Under **Admin** > **Workspace details** > **Workspace details**, tick **Get details** `GET /api/users/me` to read the workspace details of the token.</li>
  <li>Tick `GET /api/user_groups` and `GET /api/user_groups/:id` to read collaborator groups, and `GET /api/user_groups/:id/members` to read their members.</li>
  <li>Tick `GET /api/members/:id/project_grants` and `GET /api/user_groups/:id/project_grants` to read the project roles each collaborator has directly and through groups.</li>
  <li>Tick `GET /api/environment_roles`, `GET /api/project_roles` and `GET /api/roles` (legacy roles) to list roles, and `GET /api/project_roles/:id` to read one project role.</li>
  <li>Tick `GET /api/members/:id/privileges`, `GET /api/members/:id/projects_privileges`, `GET /api/environment_roles/:id` and `GET /api/developer_api_clients` only if you use the matching read-only actions in StackOne. Reading collaborators, groups and roles does not need them.</li>
  <li>Tick `DELETE /api/members/:id` and `POST /api/user_groups/:id/members` only if you want StackOne to remove a collaborator or add members to a group. Without them every read still works and these two actions are refused.</li>
</ul>

**3. Save the role**

Select **Save**.

<ul>
  <li>Workato applies changes to a client role to its API clients straight away.</li>
</ul>

## Create the API client

The API client holds the token that StackOne sends with every request.

**1. Create the client**

Navigate to **Workspace admin** > **API clients** and select **Create API client**.

<ul>
  <li>Enter a name such as `StackOne Integration`.</li>
  <li>Select the client role you just created.</li>
</ul>

**2. Choose the environment and projects**

If your workspace uses environments, select `DEV`, because Workato offers the collaborator endpoints only to clients with DEV access. Project roles in TEST and PROD projects appear only if Workato lets a DEV client read them.

<ul>
  <li>Allow all projects, so StackOne reads project roles in every project. Workato limits a client to the projects you select.</li>
  <li>Leave the allowed IP ranges empty, or add [StackOne's IP addresses](https://docs.stackone.com/gateway/concepts/connector-profiles.md#connection-issues-behind-a-firewall) so the token works only from StackOne. Workato refuses requests from any address outside the ranges, so update them when StackOne changes its list.</li>
</ul>

**3. Copy the token**

Copy the API token Workato shows after it creates the client, store it securely for use later, then select **Save**.

<ul>
  <li>The token is shown once and cannot be retrieved later. If you lose it, regenerate it.</li>
  <li>Paste it into the **API Token** field in StackOne Hub.</li>
</ul>

## Rotate or revoke the token

Workato lists no expiry date for an API client token. It stops working when you regenerate it or delete the client.

<ul>
  <li>Navigate to **Workspace admin** > **API clients** and open the API client.</li>
  <li>Select the refresh icon in the top right corner, then **Regenerate token**. The previous token fails straight away, so paste the new token into StackOne Hub.</li>
  <li>Workato also revokes a token it finds in a public GitHub repository and emails the workspace admins. Regenerate the token and paste it into StackOne Hub.</li>
  <li>Delete the API client or its client role to make Workato reject every request that uses the token.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Data center**</li>
  <li>**API Token**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.