Create and manage API tokens

Steps

1. Go to Settings → API tokens.
2. Click Create and set:
   • Scopes — what the token is allowed to do (grant only what's needed).
   • Expiry — when it should stop working.
   • IP allowlist / CIDR — optionally restrict which IPs can use it.
3. Copy the token now — it's shown only once. Store it in a secret manager, never in code you commit.
4. Revoke a token any time from the same page.

Security tips

• Use separate tokens per integration so you can revoke one without affecting others.
• Prefer short expiries and the narrowest scopes.

Troubleshooting

• 401 Unauthorized — the token may be expired, revoked, or blocked by the IP allowlist.
• Lost the token — you can't view it again; revoke it and create a new one.

Related: Create integration keys · Add a webhook endpoint