API tokens

An API token lets something that is not a person — a script, a server, another tool — act in your workspace.

Create one

1. Open Profile settings → API tokens.
2. Create a token and give it a name that says what it is for: nightly export, website form relay. In a year, token 3 tells you nothing and nobody dares delete it.
3. Copy it now. It is shown once. If you lose it, delete it and make another.

Using it

Send it as a bearer token on each request. Keep it in an environment variable or a secrets manager — never in the code you commit.

A token acts as you

This is the part worth pausing on: a token carries your access. Anything you can see and change, it can see and change.

So don't paste a token into a shared document, a chat message, or a support ticket — including one to us. We will never ask for it.

Rotating and revoking

• Revoke immediately if a token may have leaked. It stops working at once; whatever used it needs a new one.
• Rotate periodically for anything long-lived: create the new token, switch the consumer over, then delete the old one.
• Delete tokens for things you no longer run. An unused token is only a risk.

When someone leaves

Tokens belong to a person. If they leave, their tokens should go too — and anything that depended on them needs a token from someone still there. Worth checking as part of offboarding, because an integration that dies a week later is hard to connect back to the cause.

Related: Connect Atwork to your tools · Invite your team