API tokens

An API token is needed when /api/v1 is accessed not by a browser but by a script, CI, an external service, or other automation. It replaces the browser session in API requests and acts on behalf of the user who issued it.

A token does not create a separate role or grant special permissions. If the user has access to the organization, an API request with their token gets the same access; if they have no access, the token will not add any.

What a token gives

A personal token provides bearer access to protected /api/v1 routes. It is passed in an HTTP header:

Authorization: Bearer <token>

Then the request passes the same checks as a regular user in the interface: organization membership, role, and permissions for a specific action. Therefore, the token is convenient for scripts, integrations, and regular data exports, but it must be stored securely like a password.

In the current version, tokens are not configured by individual scopes. Each issued token acts with the full access of the owner within their actual permissions. If you need an external AI agent with limited scopes, use an MCP connection instead of a personal API token.

How to issue

Open the profile inside the organization and go to the API tokens section. Provide a clear name: for example, the name of the script, service, or environment where the token will be used.

The expiration date is optional. If not specified, the token will be valid until manually revoked. If specified, the token will stop providing access after this date and disappear from the active list.

After issuance, the full secret is shown once. Copy it immediately and save it in a secure vault. Later, the platform will only show the name, creation date, expiration date, and time of last use; the full text of the token cannot be recovered.

How to use securely

Create a separate token for each script or service. This way, the name in the list makes it clear where it is used, and it can be revoked without stopping other integrations.

Do not insert the token into public code, documentation, tasks, chats, or client JavaScript. For server integrations, store it in environment variables or a secret manager.

If a token might have leaked, revoke it and issue a new one. The revocation takes effect immediately: the old bearer header stops authenticating.

List and revocation

The API tokens page displays only the active tokens of the current user. The list shows the name, creation date, expiration date, and last use. Other users' tokens are not shown here.

To close access, click Revoke on the corresponding token and confirm the action. This removes exactly this token; the user account and other tokens remain in place.

An expired token does not need to be manually revoked for access security: it no longer works. But for a new integration, you need to issue a new token and replace the secret in the service that makes the API requests.