Summary
The API token format documentation says the hash part of a token is 64 hexadecimal characters. Issued tokens carry 56, the server generates 28 random bytes, and the three example tokens printed a few lines below the sentence are themselves 56 characters long. Only the sentence is wrong.
Checked on main at 3d91a51635859f13a5bc23547d323c19718629fb (unleash-server 8.1.0), OSS, stock config, Postgres 15.
What the docs say
https://docs.getunleash.io/concepts/api-tokens-and-client-keys, "API token format":
The environment value of the token is the name of an environment on your Unleash instance, such as development. The hash is a 64-character-long hexadecimal string.
What is issued
POST /api/admin/api-tokens
body: {"tokenName":"tcref-single","type":"backend","environment":"development","projects":["default"]}
-> 201
{"tokenName":"tcref-single","environment":"development","projects":["default"],
"secret":"default:development.53c1c42e212d508958e3ac8f8e8cf31e68bb823fc882a8d70d487593",
"type":"backend","alias":null,"project":"default","createdAt":"2026-08-25T14:33:30.304Z","secure":false}
GET /api/admin/api-tokens/tcref-single
-> 200
{"tokens":[{"secret":"default:development.53c1c42e212d508958e3ac8f8e8cf31e68bb823fc882a8d70d487593", ...}]}
53c1c42e212d508958e3ac8f8e8cf31e68bb823fc882a8d70d487593 is 56 hex characters.
It matches the code, and it matches the page's own examples
src/lib/services/api-token-service.ts:513-514:
private generateSecretKey({ projects, environment }) {
const randomStr = crypto.randomBytes(28).toString('hex');28 bytes hex-encoded is 56 characters.
And the examples on the same documentation page, immediately under the sentence:
new-checkout-flow:development.be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178
[]:production.be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178
be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178 is also 56 characters. So the page contradicts itself, and the prose is the half that disagrees with the product.
Why it is worth fixing
The sentence is the natural thing to build a token-format validator or a secret-scanning rule from, and a [0-9a-f]{64} pattern written from it will not match any token Unleash issues.
Suggested fix: change "64-character-long" to "56-character-long" on that page (the docs source appears to live outside this repository — happy to move the report if there is a better tracker for it).
Suggested labels: docs
Summary
The API token format documentation says the hash part of a token is 64 hexadecimal characters. Issued tokens carry 56, the server generates 28 random bytes, and the three example tokens printed a few lines below the sentence are themselves 56 characters long. Only the sentence is wrong.
Checked on
mainat3d91a51635859f13a5bc23547d323c19718629fb(unleash-server 8.1.0), OSS, stock config, Postgres 15.What the docs say
https://docs.getunleash.io/concepts/api-tokens-and-client-keys, "API token format":
What is issued
53c1c42e212d508958e3ac8f8e8cf31e68bb823fc882a8d70d487593is 56 hex characters.It matches the code, and it matches the page's own examples
src/lib/services/api-token-service.ts:513-514:28 bytes hex-encoded is 56 characters.
And the examples on the same documentation page, immediately under the sentence:
be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178is also 56 characters. So the page contradicts itself, and the prose is the half that disagrees with the product.Why it is worth fixing
The sentence is the natural thing to build a token-format validator or a secret-scanning rule from, and a
[0-9a-f]{64}pattern written from it will not match any token Unleash issues.Suggested fix: change "64-character-long" to "56-character-long" on that page (the docs source appears to live outside this repository — happy to move the report if there is a better tracker for it).
Suggested labels:
docs