---
title: "Customer tokens"
description: "Run one OpenTofu or Terraform configuration per client, each with its own customer-scoped API token and provider alias."
---

API tokens come in two scopes. An **organization token** manages the whole organization. A **customer token** reaches only the customers it is scoped to: the right fit when you run monitoring for several clients. Details: [Token scopes](/api/introduction/token-scopes-organization-vs-customer).

## One configuration per client

Give each client its own provider alias and customer token. A mistake in one client's code cannot touch another client's monitors.

```terraform
variable "acme_token" {
  type      = string
  sensitive = true
}

provider "uptimeify" {
  alias     = "acme"
  api_token = var.acme_token
}

data "uptimeify_customer" "acme" {
  provider = uptimeify.acme
  name     = "ACME GmbH"
}

resource "uptimeify_website" "acme_shop" {
  provider    = uptimeify.acme
  customer_id = tonumber(data.uptimeify_customer.acme.id)
  name        = "ACME shop"
  url         = "https://shop.acme.example/"
}
```

With Terragrunt, generate the `provider` block and pass the token per unit, as with any other provider.

## What a customer token can do

A customer token manages the monitors of its customers; monitors it creates are always `self_service`. It cannot create customers. On an organization-wide resource the API answers `403 customerScopedTokenForbidden`; a token that lacks a scope gets `403 apiTokenScopeForbidden` with the missing scope in `data.requiredScope`. Which endpoint needs which scope: [Permissions by endpoint](/api/introduction/permissions-by-endpoint).

Resources that can be scoped either way, such as [`uptimeify_tag`](/terraform/resources/tag), must set `customer_id` when you use a customer token.