An API token lets a script, integration, or AI assistant act as you, limited to the permissions you choose. Tokens work for the REST API and for connected AI tools.
Find them
Any of these opens the same page:
- Settings → API tokens on the Settings hub.
- Settings → Developer, then API tokens in the Developer menu.
- Press
Cmd+Kand search for "API tokens" (see Search and the setup guide).
The page lists each token with its Name, Permissions, Last used, and Expires. Use the search box to find one.
Create a token
-
Choose Create token.
-
Enter a Name that says what the token is for, such as "Zapier" or "Reporting script".
-
Pick Permissions:
- Read forms and responses
- Create submissions
- Edit and publish forms
- Reply in Desk
Open Fine-grained permissions for the full list of abilities.
-
Choose when it Expires: in 90 days, in 1 year, or never.
-
Create the token and copy it straight away. For your security it is not shown again.
Keep it in a password manager or secrets store. Give each tool its own token with the least permissions it needs, so you can revoke one without breaking the rest.
Change or revoke a token
- Edit the permissions of an existing token from its row.
- Revoke deletes a token. Anything using it stops working immediately until you paste in a new token.
Next
- API authentication → - send a token with each request
- Tokens & abilities → - what each ability allows
- AI assistants (MCP) → - connect Claude, Cursor, and others
