API Tokens
Generate and manage API tokens for server-to-server automation. A token is sent as X-API-Key and is accepted on a deliberately narrow set of endpoints — it is not a drop-in replacement for a JWT session token.
The raw token is shown exactly once
POST /api-token (and POST /api-token/regenerate) is the only place the token value is ever returned. The server stores just a SHA-256 hash and an 8-character prefix, so it genuinely cannot hand the token back later — GET /api-token returns metadata only. Capture it into your secret store on creation; if it is lost, regenerate (which invalidates the previous token immediately).
Generate API Token
const response = await fetch(BASE_URL + '/api-token', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + accessToken }
});
const data = await response.json();
// { "success": true, "token": "550e8400-e29b-41d4-a716-446655440000" }
//
// THIS IS THE ONLY TIME THE RAW TOKEN IS RETURNED. Store it now — the server
// keeps only a SHA-256 hash plus an 8-char prefix, so it cannot be recovered.
// Lost it? Call POST /api-token/regenerate, which mints a new one and
// immediately invalidates the old.Get Token Metadata
// Returns METADATA only — never the token itself.
const response = await fetch(BASE_URL + '/api-token', {
headers: { 'Authorization': 'Bearer ' + accessToken }
});
const data = await response.json();
// {
// "success": true,
// "tokenData": {
// "prefix": "550e8400", // first 8 chars, for display/matching
// "createdAt": "2026-02-25T10:00:00Z",
// "regeneratedAt": "2026-06-01T09:15:00Z",
// "exists": true
// }
// }
//
// No token issued yet:
// { "success": true, "tokenData": null }Regenerate Token
const response = await fetch(BASE_URL + '/api-token/regenerate', {
method: 'POST',
headers: { 'Authorization': 'Bearer ' + accessToken }
});What an API token can actually do
A token does not grant full access to your account. It is accepted on 19 route registrations across four families, scoped to the issuing account’s projects — every other endpoint returns 401, including GET /projects/:id, materials, assets and token management itself (see Authentication).
That grant is still write access, not read-only. Within those four families it includes create, update and delete:
- • Option blocks — create, update, delete and reorder blocks and their variants, plus
/evaluate. A holder can restructure a live configurator. - • Pricing blocks — create, update and delete pricing blocks, plus
/calculate. A holder can change what a product costs. - • Quote submissions — read, update and delete captured leads, including the customer contact details in them.
- • Webhooks — create, update and delete webhook registrations. A holder can repoint your lead-delivery webhook at their own endpoint, or delete it so submissions stop being delivered anywhere.
Treat it as a production credential: keep it server-side, never commit it to version control, and regenerate immediately if it is exposed. It is also disabled while a subscription is inactive, and rotated automatically 90 days after a lapse.