Docs · Connect your tools
Connect Snyk
StackWeaver reads, and never changes, one read-only endpoint on your Snyk account once a day, through an API token you create yourself. This guide says exactly what is read, which permission the token needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls Snyk's REST API with the token you paste. The result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including a result that fails.
| Check (as shown in the portal) | What it looks at |
|---|---|
| API token valid and reachable | Whether the stored token is accepted and Snyk's own account endpoint responds with your account's opaque id. Evidence only: no threshold is applied. |
2. What it does not do
- It never reads project, scan or vulnerability data. The one check reads only your own opaque account id, never a finding or a repository.
- It cannot change anything: the token is used for one read-only endpoint.
- It does not say your security programme meets any requirement. A result is what Snyk returned at a certain time.
3. The access it needs
One credential: an API token, sent as `Authorization: token <API_TOKEN>` on every request (Snyk).
Who can connect. In StackWeaver, a workspace owner or admin pastes the token. Snyk does not tell StackWeaver who created the token or what role they hold, so create it with no more access than this one read-only check needs.
4. Connect steps
- In Snyk's account settings, open General and copy your personal API token (or create a service account token).
- In StackWeaver, open Evidence, the Snyk section, and paste the token.
- Press Test connection. StackWeaver records the result and fills in the account id automatically.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Snyk section. StackWeaver deletes the stored token.
- In Snyk's account settings, revoke or regenerate the token yourself — StackWeaver has no way to ask Snyk to revoke a token on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Snyk refused the token: it may be wrong or revoked | Check the token was copied in full and has not been regenerated in Snyk |
| This token belongs to a different Snyk account than the one already connected here | Disconnect first if you mean to switch to a different Snyk account |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.