July 15, 2026 - Install token lifecycle safety

Install token management now consistently enforces one active token per app install and environment.

Affected surfaces

• Developer Portal
• Install token API
• Docs

Changes

• Creating a token while the install already has an active token returns 409 app_install_token_already_active instead of an internal error.
• Rotation atomically replaces the active token. If replacement fails, the previous token remains active.
• The portal shows create only when no active token exists; use Rotate to replace an active token.

Developer action

If your portal integration receives app_install_token_already_active, rotate the active token or revoke it before creating a new one. Raw token values remain available only in successful create and rotate responses.