Ce guide n’est pas encore traduit dans votre langue.
This page explains how to create and manage API tokens from the dashboard. For what tokens are and how to use them, see API tokens.
Where to find them
Go to Organization → API. The tab shows your tokens (label, type, preview of the token, creation date, last use and number of calls) and your API usage: calls this month against your plan's quota and recent calls. The API tab is visible to admins and owners.
Creating a token
- Click Generate new token.
- Enter a label (for example
marketing-site-prod). - Choose the type:
- Application — calls the API within its scopes.
- Document — opens a single document on its public address. Choose the document.
- Optionally limit the scopes and set an expiry date.
- Click Generate.
The token is shown in a copyable field. Store it in a secret manager immediately.
Regenerating a token
Tokens should be replaced periodically (every 90 days is a good rule) and immediately if you suspect a leak. For zero downtime:
- Create a new token.
- Deploy it to your application.
- Revoke the old token.
If a token leaks, use Regenerate on it: the old token stops working at once and you get a new one with the same label and expiry.
Revoking and deleting
Revoke a token to stop it working immediately (it then answers 401). A revoked token can then be deleted permanently from the list. Only the owner can delete tokens permanently.
Token limits and quota
The number of tokens, the calls per month and the calls per minute depend on your plan. Only calls made with an API token count; using the dashboard does not. When a limit is reached the API answers 429; you can buy extra API calls as an add-on or move to a higher plan.
Security best practices
- Never commit tokens to git. Use environment variables or a secret manager.
- Never expose application tokens in client-side code. Use a document token or the public address for browsers.
- Always use HTTPS.
- Use the narrowest scopes and set expiry dates for temporary integrations.
- Replace tokens when someone with access leaves.
- Review the usage regularly. A token you don't recognize with recent activity should be revoked immediately.