API Tokens

API tokens provide programmatic access to your team's data via the REST API. Tokens are scoped to the team they are created in and use Laravel Sanctum for authentication.

Generating a Token

Go to Team Settings → API Tokens.
Enter a descriptive Token Name to identify what or who the token is for (e.g. GitHub Actions, Zapier, Mobile App).
Click Create Token.
Copy the token from the confirmation panel. This is the only time you will see the token value.

Copy your token now

The token value is only shown once. If you lose it, you must delete the token and create a new one.

Using Your Token

Include the token as a Bearer token on every API request:

Authorization: Bearer YOUR_TOKEN_HERE
Accept: application/json

See Authentication for full examples.

Managing Tokens

All tokens for the team are listed in Team Settings → API Tokens. Each entry shows the token name and the date it was last used. You can have multiple active tokens simultaneously — useful for giving separate credentials to different integrations.

Revoking a Token

To revoke a token, click Delete next to it in the API Tokens list. The token is invalidated immediately. Any requests using the revoked token will receive a 401 Unauthorized response.

Security Best Practices

Give each integration its own named token so you can revoke individual access without affecting others.
Never commit tokens to version control — use environment variables or a secret manager.
Rotate tokens periodically, especially after team member changes.
Revoke tokens that are no longer in use.