When creating an API token in integrator.io, you can restrict its access to specific Celigo Storage folder paths. This path scoping enforces the principle of least privilege, ensuring external processes only access authorized folders. Any request made outside the allowed paths is automatically blocked with an error.
Set file storage paths on a token
- Go to Resources > API tokens, and then generate a new token or edit an existing one.
- For the token’s scope, select Custom.
- In File storage paths, enter a comma-separated list of folder paths.
- Save the token.
Path matching rules
- Matching is prefix-based, with no wildcard support — each path grants access to the folder and to every file and folder beneath it.
- A path of
/grants access to all of Celigo Storage. - A path doesn’t have to exist when you save the token. If a folder in the path is deleted later, or hasn’t been created yet, the token has no content to access at that path.
- A path that matches more than one folder (for example, two folders with the same name in different locations) grants access to the descendants of every matching folder.
- Requests outside the allowed paths are denied with an error.
Note: A token’s storage access is also governed by the role and integration access of the user it belongs to. Path scoping narrows access — it never grants access beyond what the user’s role allows.