Access the API and refresh an API token

Each user has one current API token. The token lets programs perform actions with that user's permissions.

Open the API page

Open Account settings → API. The page displays the full current token and a copy button.

Important: An API token is secret information. Anyone with the token can access data within your permissions. Do not send it by email, put it in browser-run code, or store it in public documentation.

Use the token

Prefer sending the token in an authorization header:

Authorization: Bearer YOUR_API_TOKEN

The documentation page also describes passing the token as a query parameter, but that method is more likely to appear in URL history and logs. The header is the option recommended by the interface.

Copy the token

Select Copy, then paste the token into the integration's secret store. The token can still be viewed on this page; it is not shown only once.

Regenerate the token

Important: Regenerating the token immediately replaces the current token. Any integration still using the old token will stop working.

1. Prepare to update every integration using the token.
2. Select Regenerate token.
3. Confirm.
4. Copy the new token and update each integration.
5. Test the integration with a safe read request.

This page does not provide multiple tokens, separate scopes, expiration dates, usage history, or parallel token rotation.

Next steps

• API documentation overview
• Set up two-factor authentication