API & WebhooksAPI Tokens

API Tokens

Creating tokens with abilities, IP allowlists, expiration, and rate limits.

API Tokens

Overview

API tokens let external applications access your account data programmatically. Each token is scoped to a specific membership (account context) and has configurable permissions, IP restrictions, and rate limits.

Creating a Token

Go to Settings > API Tokens and click Create Token. Configure:

  • Name — a descriptive label for this token (required, max 255 characters). Example: "Zapier Integration" or "Website Form Sync".
  • Abilities — select which permissions this token should have (required, at least one). Abilities match the permission slugs used by the role system (e.g., contacts.view, contacts.create, documents.view). Only subaccount-level permissions are available for API tokens.
  • IP Allowlist — optional, restrict which IP addresses can use this token. Supports:
    • Single IPs: 192.168.1.1
    • CIDR ranges: 192.168.1.0/24
    If no IPs are specified, the token can be used from any IP address.
  • Expiration — optional, set a date after which the token stops working. Must be in the future.

Token Security

  • The full token is shown only once at creation. Copy it immediately and store it securely. It cannot be retrieved later.
  • Tokens are stored as SHA-256 hashes in the database.
  • Use the minimum abilities needed for each integration.
  • Set IP allowlists when the calling server has a known, static IP.
  • Set expiration dates for temporary integrations.
  • Revoke tokens immediately if they may be compromised.

Using a Token

Include the token in the Authorization header of every API request:

Authorization: Bearer your-api-token-here

Rate Limiting

Each token has a rate limit (default: 60 requests per minute). You can set a custom rate limit per token when creating it. Response headers include X-RateLimit-Remaining so your integration can throttle accordingly.

Token Tracking

The system tracks each token’s usage:

  • Last used IP — the most recent IP address that used this token
  • Request count — total number of API requests made with this token
  • Last used at — timestamp of the most recent request

Revoking Tokens

Delete a token from the API Tokens page to immediately revoke it. All subsequent API requests using that token will return a 401 Unauthorized error.

Was this article helpful?

Keep reading

Authentication & Basics Contacts Entity Types