Skip to main content
Updated Aug 4, 2026

API Tokens

What you'll learn
  • What public API tokens are and when you need them
  • How to create, view, and manage tokens
  • Security best practices for handling tokens

Public API Tokens allow external applications, scripts, and services to authenticate with AutoTalk's API. You manage tokens from the API Tokens page under Integrations in the sidebar.

When you need API tokens​

You need an API token whenever an external system needs to communicate with AutoTalk programmatically. Common scenarios include:

  • Connecting a CRM or helpdesk system that pushes or pulls data from AutoTalk
  • Building a custom integration that sends messages or reads conversations through the API
  • Setting up automation scripts that create contacts, update records, or trigger workflows
  • Integrating unsupported platforms or internal systems through a custom bridge, such as a Discord notification pipeline

Managing tokens​

Viewing existing tokens​

Navigate to Integrations > API Tokens. The page lists all of your existing tokens. You can filter the list, open a token to view its details, and delete tokens; tokens can't be edited after creation.

Creating a new token​

  1. On the API Tokens page, click the + button (its tooltip reads "Add new public_api_tokens").
  2. Review the generated alias or replace it with your own label.
  3. Choose a lifetime. New tokens default to 90 days, with options for 7, 30, 90, 365 days, or never expiring.
  4. Save the token.
  5. Copy the generated token or the Codex / Claude Code MCP command immediately. The full token is displayed only once.

Viewing or deleting a token​

  • Click on any token in the list to view its details, expiration, and usage stats.
  • To revoke a token, delete it from the list. Any external system using that token will immediately lose access.

Using tokens in API requests​

Pass the token in the x-api-key header of every request to the AutoTalk public API. Keys always start with sk-:

x-api-key: sk-YOUR_API_KEY

A minimal curl example:

curl -H "x-api-key: sk-YOUR_API_KEY" https://api.autotalk.io/v1/self

See the API Reference for the full endpoint catalog.

Alternative: x-jwt-token​

The same API also accepts short-lived JWTs via the x-jwt-token header (or the unified x-auth-token header that sniffs the sk- prefix to route automatically). JWTs are issued internally by the actions/security/auth/jwt/generate assistant workflow action — they are meant for agents calling the public API on their own company's behalf. External integrations should stick with x-api-key. See Authentication for the full spec.

Security best practices​

  • Treat tokens like passwords. Never share them in public code repositories, chat messages, or emails.
  • Use descriptive names. Label each token with the integration or system it belongs to, so you can identify it later.
  • Revoke unused tokens. If an integration is retired or a token is no longer needed, delete it immediately.
  • Rotate tokens periodically. Replace tokens on a regular schedule to reduce the risk if one is accidentally exposed.
  • Assume full access. Tokens have no permission scopes — every token grants full owner-level access to the public API and the MCP server. Treat a leaked token as a full-account compromise, and use a separate token per integration so revocation is targeted.
tip

If you suspect a token has been compromised, revoke it immediately by deleting it from the API Tokens list, then create a new one and update the affected integration.

Next steps​

Last updated on
On this page