diff --git a/docs/open360/settings/api-tokens.md b/docs/open360/settings/api-tokens.md
new file mode 100644
index 00000000..2b55eaf9
--- /dev/null
+++ b/docs/open360/settings/api-tokens.md
@@ -0,0 +1,34 @@
+---
+sidebar_position: 2
+title: API Tokens
+description: API tokens now carry a role that scopes what they can do - Admin, User, or Read-only.
+image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg
+keywords: [logz.io, api tokens, api token roles, permissions, read-only token, security, manage tokens, settings, observability]
+---
+
+API tokens under **Settings → Manage Tokens → API tokens** now carry a **role**, so a token can be scoped to what it actually needs rather than defaulting to full account access.
+
+For creating and deleting tokens, and how each account type gets its own tokens, see [Manage API Tokens](https://docs.logz.io/docs/user-guide/admin/authentication-tokens/api-tokens/) — that part is unchanged. This page covers roles.
+
+:::note
+API token roles are rolling out gradually. If you don't see a **Role** column, it isn't enabled for your account yet — contact [Logz.io support](https://logz.io/support-page/).
+:::
+
+## Roles
+
+| Role | Meaning |
+|---|---|
+| **Admin** | Full access. The default for any token, including tokens created before roles existed. |
+| **User** | Standard access. |
+| **Read-only** | Read-only access — the one to reach for when a token only needs to pull data out, such as an export job or a read-only integration. |
+
+Every token created here gets **Admin** by default, so if you want a scoped token, set the role explicitly rather than leaving it at the default.
+
+## Set a token's role
+
+Select the **Role** column on an existing token to change it, or set it while creating a new one.
+
+## Related
+
+* [Manage API Tokens](https://docs.logz.io/docs/user-guide/admin/authentication-tokens/api-tokens/)
+* [API cookbook](https://docs.logz.io/docs/user-guide/integrations/api-cookbook/cookbook/)