Skip to main content
Every request authenticates with a Bearer token in the Authorization header:
Every endpoint uses the same kind of token: a scoped API token from the Keys page. Each token only reaches your own account’s agents and data.

​
API tokens

Create a token on the Keys page of your dashboard (“Generate access token”). The token is shown once - copy it right away and store it securely. The Keys page lists each token’s description, scopes, expiry and status afterwards, never the token itself. When you generate a token you choose:
  • Scopes - what the token may do (see below). At least one is required.
  • Expiration - 30, 90 or 180 days, or no expiry. The default is 90 days. An expired token is rejected with 401; generate a new one before the date.
  • IP whitelist - optional. Single addresses (203.0.113.10) or CIDR ranges (203.0.113.0/24), IPv4 or IPv6. Empty means the token works from any address.
Revoke a token from the Keys page when you no longer need it. Revocation is immediate and cannot be undone; the token stays listed as revoked.

​
Scopes

A scope is resource:action. Each endpoint page lists the scope it requires. A token without that scope receives 403. resource:* grants every action of that resource, for example tools:* covers tools:read, tools:write and tools:execute. Grant only what the integration needs; a token for a reporting job needs voice_agents:read and conversations:read, nothing more.

​
Failed authentication

A missing, invalid, expired or revoked token returns 401; a missing scope returns 403. Both use a short envelope:
The message is absent on some 403 responses. See Errors for the other error formats.