Skip to content

Typeform API Token

Service Name: Typeform

Service Description: Typeform is a web-based platform that allows users to create and distribute online forms, surveys, quizzes, and questionnaires with a focus on user experience and design.

Service Address: https://www.typeform.com/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants programmatic access to create, read, update, and delete Typeform forms, responses, and account data through the Typeform API.

Secret Revokement URL: https://admin.typeform.com/user/tokens

Secret Example: tfp_6AByD2aPVcnZmQWsWLJXNTYC8aMEP1z3r4F5G6H7_3JK4LMnOPqRsT

Suspicious Activity Investigation Instructions:

  • Review the Typeform account for unauthorized forms or changes to existing forms.
  • Check API logs for unusual API calls or access patterns.
  • Monitor for unexpected data exports or form response downloads.
  • Verify if there are any new integrations or webhooks that were not authorized.
  • Check for unusual geographic access locations in account activity logs.

Mitigation Instructions:

  • Log in to your Typeform account at admin.typeform.com.
  • Navigate to your profile settings by selecting your profile icon in the upper-right corner.
  • Select Personal tokens from the menu.
  • Locate the compromised token and select Revoke to immediately invalidate it.
  • Create a new token with appropriate scopes if still needed.
  • Review and update any applications or integrations that were using the old token.
  • Enable two-factor authentication for your Typeform account if not already enabled.
  • Review account activity for any suspicious actions taken with the compromised token.