# Create and manage API tokens

## Steps

1. Go to **Settings → API tokens**.
2. Click **Create** and set:
   - **Scopes** — what the token is allowed to do (grant only what's needed).
   - **Expiry** — when it should stop working.
   - **IP allowlist / CIDR** — optionally restrict which IPs can use it.
3. **Copy the token now** — it's shown only once. Store it in a secret manager, never in code you commit.
4. **Revoke** a token any time from the same page.

## Security tips

- Use separate tokens per integration so you can revoke one without affecting others.
- Prefer short expiries and the narrowest scopes.

## Troubleshooting

- **401 Unauthorized** — the token may be expired, revoked, or blocked by the IP allowlist.
- **Lost the token** — you can't view it again; revoke it and create a new one.

**Related:** Create integration keys · Add a webhook endpoint