# Device tokens (https://logable.app/docs/integrate/device-tokens)

How a device token works, how to rotate one without a gap, and what a revoked token sees.



A device token is the credential a device sends with every reading, over HTTP or over MQTT. Logable checks it on every request.

## What a token is [#what-a-token-is]

A device token is 64 hexadecimal characters. Logable shows it once, at creation or at rotation, and never shows it again. Each device holds one active token at a time.

Send the token as a bearer credential over HTTP. Send the same token as the MQTT password.

## Rotate without a gap [#rotate-without-a-gap]

Open the device's **Connection** tab and choose **Regenerate Token**. Logable issues a new token straight away. The old token keeps working for 24 hours.

Update the device with the new token during that window, then let the window expire on its own.

Each regeneration revokes only the token that was active at that moment, and gives that one its own 24-hour grace window. Regenerating again while an earlier token is still inside its own grace window does not cut that window short. Every revoked token keeps the grace period it was given.

See [Rotate or revoke a device token](/docs/guides/devices/rotate-or-revoke-a-device-token) for the full walkthrough.

## Revoke immediately [#revoke-immediately]

Choose **Revoke** on the token's row when a token is compromised. Revocation has no grace period.

Ingest caches token checks for up to 30 seconds. A revoked token may still be accepted during that short window, until the cache clears.

## What a revoked device sees [#what-a-revoked-device-sees]

Over HTTP, the next request with a revoked token gets HTTP 401 with `code: "UNAUTHORIZED"`.

Over MQTT, a new connection attempt is refused. An already-connected device is not dropped straight away. Its next published message is silently rejected once Logable notices the revoke.

## Streams [#streams]

A stream token works the same way as a device token. Rotation and revocation follow the same rules, and the grace period also defaults to 24 hours.

## Next [#next]

* [Rotate or revoke a device token](/docs/guides/devices/rotate-or-revoke-a-device-token)
* [Send readings over HTTP](/docs/integrate/rest-api)
* [Publish readings over MQTT](/docs/integrate/mqtt)