---
title: 'API tokens'
description: 'Create and revoke credentials with appropriate project authority.'
---

# API tokens

Open **project API** and choose **Create New Token**. The form provides **Token Name** and **Permissions**; the permission choices include Contributor, Developer, Editor, and Viewer.



## Issue a credential

1. Give the token a name that identifies its integration and environment.
2. Select the smallest role that supports the intended work. Prefer Viewer for read-only integrations.
3. Store the issued value in the trusted application's secret store.
4. Test a small permitted request and an operation that should be denied.

The current project form does not provide a space or expiry selector. Do not assume a token inherits all the issuer's space grants. Test access to space-bound resources explicitly and use a supported access path when the required authority cannot be configured.

## Rotate or revoke

Issue a replacement, deploy it to the intended consumer, verify requests, then revoke the previous credential through its management controls. Revoke a compromised token immediately and inspect relevant logs. Do not include the token value in a support request.

Team API controls and project tokens are different administrative contexts. Use project-specific credentials for the documented project data examples and consult the particular API contract before using a team credential.

See [authentication](/docs/api/authentication) and [members and permissions](/docs/dashboard/members).


---

[View full sitemap](/docs/sitemap.md)