Skip to content
LogoLogo

API tokens

Personal access tokens let scripts and external tools call the Discontinue API as you. Create and manage them under Account → API tokens. A token authenticates like your login does: it carries your identity and your current role in a workspace, checked live on every request. It never grants more than you can do yourself, and several things less (see below).

Send it as a bearer header:

Authorization: Bearer dpat_...

Creating a token

  1. Open Account → API tokens and choose a name.
  2. Pick a scope: Read-only (GET requests only) or Read & write.
  3. Pick a binding: one workspace, or all my workspaces.
  4. Optionally set an expiry (1 to 365 days).

The full secret is shown exactly once, right after creation. We store only a hash; if you lose the secret, revoke the token and create a new one. The list shows a short prefix, the scope, the binding, and when each token was last used.

Workspace binding

  • A workspace-bound token works in that one workspace only. It cannot see or reach your other workspaces, even though you can.
  • An all-workspaces token can act in any workspace you are a member of, but must name one on every request with the X-Workspace-Id header. If the header is missing or names a workspace you cannot access, the API returns an error listing the workspace ids the token can use.

What a token can never do

Regardless of scope, a token cannot:

  • Manage your account (password, two-factor, deletion)
  • Create, delete, or switch workspaces
  • Create or revoke API tokens
  • Access billing (subscription, wallet, invoices)
  • Access admin surfaces

Tokens follow your access

A token's rights are your rights at the moment of the request, not at the moment of creation:

  • If your role in a workspace changes (see Team & roles), the token's rights change with it immediately.
  • If you are removed from a workspace, tokens bound to it stop working immediately; an all-workspaces token loses that workspace.
  • If your account is deleted, all your tokens are deleted with it.

Requests made with a token count against the same plan quotas and spend limits as work done in the app (see Limits & cost controls).

Revoking

Revoke a token any time from Account → API tokens. Revocation is immediate and permanent. Treat a token like a password: if it may have leaked, revoke it first and ask questions later.