Developer API and webhooks

API tokens: create, use, and revoke

Mint an API token from your dashboard, copy the one-time secret, authenticate requests to the REST API with a Bearer header, and revoke a token when you're done.

Create a token

API tokens live in your dashboard under API & webhooks. In the API tokens card, give the token an optional name (something like "Zapier" or "CI pipeline" so you can tell them apart later) and click Create token.

The token is shown to you exactly once, in a highlighted panel:

Copy this token now. This is the only time the full token is shown. It isn't stored anywhere - if you lose it, revoke it and create a new one.

Use the Copy button, paste it into your integration's secrets, and dismiss the panel. We keep only a one-way hash of the token plus its short prefix - we can't show you the full value again, by design.

After that, the tokens table shows each token by its prefix (for example qr_1a2b3c4d5…) so you can recognize it without ever exposing the full secret. The table also shows when each token was created, when it was last used, and whether it's active or revoked.

Authenticate your requests

Every call to the REST API (under /api/v1) authenticates with your token in an Authorization header using the Bearer scheme:

Authorization: Bearer qr_your_token_here

For example, fetching the identity behind a token:

curl https://your-domain/api/v1/me \
  -H "Authorization: Bearer qr_your_token_here"

If the header is missing, malformed, or the token isn't recognized, you'll get a 401 with code invalid_token. A revoked token also returns 401, but with its own code, revoked_token, so your integration can tell "never valid" apart from "used to work, now revoked."

Revoke a token

To turn a token off, click Revoke next to it and confirm. Revocation is immediate - any integration still using that token stops working right away, and the token's status flips to Revoked in the table. Revoking is the fix for a leaked or lost token: revoke it, then create a fresh one.

Who can manage tokens

In a team workspace, only admins and owners can manage API tokens. On a personal account, there is no workspace role to manage.

Build a dynamic code first - the API and webhooks operate on the codes in your account.

Create a QR code

FAQ

I lost my token. Can you send it again? No - the full token is shown only once and never stored. Revoke the old one and create a new token.

What does the "prefix" in the table mean? It's the first several characters of the token (starting with qr_), safe to display so you can identify a token without revealing the secret.

Does revoking take effect immediately? Yes. Any request using a revoked token is rejected right away.