Who can open the app — access and the web app token

Who can open your web app and snippets, how this depends on whether the service is public or requires a token, and how to create, renew and remove the web app token.

The short version

Whether a service requires a token is set under API → Access (Zugriff). See Tokens and access.

In both cases the service must be published.

Public services

For a public service there is nothing to set up. Open Apps → Web App → Default App (Web-App → Standard-App), copy the Web App URL and share it. Snippets work the same way.

Keep in mind that a public link can be passed on. Everyone who gets it can run calculations, and each calculation counts toward the calls of your plan.

Services that require a token

A protected service does not open its web app for a plain link. It needs a web app token: a key that belongs to the web app of this one service and travels inside the link.

Create the web app token

1. Open your service and open Apps → Overview (Übersicht).
2. In the card Token Management (Token-Verwaltung), click Generate Token & Enable Web App (Token erstellen & Web-App aktivieren).
3. Click Save (Speichern) at the top of the service page.
4. The menu now shows Web App and Web Snippets. Open Web App → Default App: the Web App URL contains the token as ?token=…. Share this complete address.

Until a token exists, Web App and Web Snippets are not in the menu.

What visitors see

Renew the token

Use this when a link reached people who should no longer have access.

1. Open Apps → Overview. The card shows the current Web App Token (Web-App-Token).
2. Click the button with the tooltip Regenerate token (Token neu erstellen).
3. Click Save.
4. Copy the new Web App URL (and the snippet code, if you use snippets) and hand it out again.

All links with the old token stop working. The hint in the card says the same: "Regenerate to revoke access to old links".

Remove the token

1. Open Apps → Overview and click the red button with the tooltip Disable web app (Web-App deaktivieren).
2. Confirm Disable Web App: "This will disable the web app and invalidate the current link."
3. Click Save.

The web app and the snippets of this service are then closed until you create a new token.

Web app token and API tokens are different things

Do not put an API token into a web app link, and do not give a web app link to a program that should call the API. For calling from code, see Tokens and access.

Good practice

• Treat a link with a token like a password: everyone who has it can use the calculator. There are no separate logins per visitor.
• For a calculator on a public website, a public service is the natural fit. If you embed a snippet of a protected service, the token is part of the page's code and readable for everyone who can open the page.
• If you need to know who calls, or want to cut off single callers, use the API with named tokens instead of the web app. See How a service is protected.
• The web app token does not expire by itself. It is valid until you regenerate or remove it.
• Visitors see inputs and results only. The workbook and its formulas are never sent to the browser.

For developers and agents

• Web app: https://spreadapi.io/app/v1/services/{serviceId}?token={webAppToken}
• Snippet: https://spreadapi.io/app/v1/services/{serviceId}/view/{templateId}?interactive=true&token={webAppToken}
• For a public service, leave token out.
• The web app token is a string of 32 letters and digits. API tokens look different: they start with svc_tk_.
• Changes to the token take effect after Save; publishing again is not needed.
• An agent cannot create or read a web app token over the API. Ask the service owner to copy the complete link from Apps → Web App → Default App.

FAQ

Who can open my web app?

For a public service, anyone with the link. For a service that requires a token, anyone whose link includes the current web app token.

How do I protect my web app?

Make the service require a token under API → Access, then create a web app token under Apps → Overview → Token Management and click Save. Only links that include this token open the app.

Where do I find the web app token?

Under Apps → Overview, in the card Token Management. The card is shown for services that require a token, and the token is also part of the Web App URL.

Why are Web App and Web Snippets missing from the Apps menu?

Your service requires a token and has no web app token yet. Open Apps → Overview, click Generate Token & Enable Web App, then Save.

What does "No Web App Token" or "Token Required" mean?

The service requires a token, and the web app token has not been created. Create it under Apps → Overview → Token Management and save.

How do I stop an old link from working?

Open Apps → Overview, click Regenerate token and then Save. Every link with the old token shows "Invalid Token" from then on; share the new link with the people who should keep access.

A visitor sees "Invalid Token". What happened?

The token in their link is not the current one, usually because it was regenerated or the link was cut off when copying. Send them the current address from Apps → Web App → Default App.

Can I use my API token for the web app?

No. The web app has its own token, created under Apps → Overview. API tokens are for calls from code, automation tools and AI.

Can I give each visitor their own login?

No. Everyone with the link has the same access. If you need named, separately revocable access, use the API with one token per caller; see Tokens and access.

Does the web app token expire?

No. It stays valid until you regenerate it or remove it under Apps → Overview.

I made my public service protected. Why did my web app link stop working?

A protected service opens its web app only for links that carry the web app token. Create the token under Apps → Overview, save, and share the new Web App URL.

As an agent, can I open a protected web app with the service's API token?

No. A protected web app opens only with the web app token in the link, which the owner copies from the Apps tab. To calculate, call the API with the API token instead.