Skip to main content
Access tokens authenticate external systems against the public REST API. They’re managed on the Access tokens page (owners and members; viewers have no access).

​
Scopes

A token can only do what its scopes allow. Grant the minimum you need: Each scoped API operation documents its requirement. See the endpoint pages in the API Reference, or the x-required-scopes field in the OpenAPI spec. For the recommended scopes by Zap step, see Zapier.

​
Creating a token

The Create access token wizard has three steps:
1

Permissions

Select scopes.
2

Security

Name the token, optionally set an expiration date (leave empty for non-expiring), and opt into expiry notifications: email reminders 30, 14, 7, 3, and 1 days before expiry, sent to recipients you choose.
3

Review

Confirm and create. The token secret (plt_...) is shown only once. Copy it immediately and store it in your secret manager.
Treat access tokens like passwords. Never commit them, never embed them in client-side code, and scope them narrowly. If a token leaks, revoke or rotate it immediately.

​
Rotating and revoking

  • Rotate issues a new secret for the same token (shown once, like at creation) and invalidates the old secret. Use it for scheduled rotation or after a suspected leak.
  • Revoke permanently disables the token.
  • Edit adjusts the name, scopes, expiry, and notification settings.
The token list shows each token’s expiry state (“Never expires”, “Expires in N days”, “Expired”) so stale credentials are easy to spot.

​
Using a token

Send it as a bearer token (or X-API-Key header):
See the API overview for the base URL, errors, and pagination.