The API uses a personal access token (a "Web API token") sent as a bearer token.

Getting your token

Go to the Web API page in your account (linked from your dashboard). If you do not have a token yet, choose Generate token and give it a name (the default name is "Default Web API token").

Your new token is shown once, immediately after you generate it:

Your new Web API token is shown once. Copy this token now. For security, it will not be shown again. If a token is exposed in logs or screenshots, regenerate it.

After that, the Web API page only shows a short prefix of your token, along with its name, when it was created, and when it was last used.

Sending your token

Send your token in the Authorization header on every request:

Authorization: Bearer YOUR_API_TOKEN

Replace YOUR_API_TOKEN with your real token. Every request is scoped to your own account — you cannot use it to see or change another account's data.

One token at a time

Only one Web API token can be active per account. Choosing Regenerate token immediately invalidates your previous token and issues a new one.

Revoking your token

Choose Revoke token on the Web API page to disable it immediately. Requests using a revoked token will stop working.

Note

Your token is stored as a one-way hash. If you lose it, you cannot recover the original value — you can only revoke it and generate a new one.