API Tokens | Test And Accept Docs

An API token starts with tnda_ and signs in to the REST API. Send it on every request:

curl -sS https://api.testandaccept.com/api/rest/projects \
  -H "Authorization: Bearer $TANDA_TOKEN"

Tokens don’t work on the MCP server, which uses OAuth sign-in.

What a token can do

It acts as you. It has your access in its organization, and there are no narrower scopes.
It belongs to one organization. That’s whichever was active when it was made. To work in another organization, create another token.
It doesn’t expire. It keeps working until you revoke it.
It can’t manage tokens or organizations. Creating and revoking tokens, creating organizations and accepting organization invitations all need a signed-in session.

Create a token in the app

Sign in and choose the organization.
Open Developer.
Create a token, and copy it straight away. It’s only shown once.

Use this if you sign in with Google, GitHub or Microsoft, or use two-factor authentication.

Create a token from a terminal

You need a session first. This signs in with your password and keeps the session in a cookie file:

export TANDA_APP=https://www.testandaccept.com
export TANDA_JAR="$(mktemp)"

curl -sS --fail-with-body -o /dev/null -b "$TANDA_JAR" -c "$TANDA_JAR" \
  "$TANDA_APP/api/auth/sign-in/email" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d "$(jq -n --arg email "$TANDA_EMAIL" --arg password "$TANDA_PASSWORD" \
    '{email: $email, password: $password}')"

Choose the organization. /api/organizations lists yours:

curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/organizations" | jq

curl -sS --fail-with-body -o /dev/null -b "$TANDA_JAR" -c "$TANDA_JAR" \
  "$TANDA_APP/api/auth/organization/set-active" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d "$(jq -n --arg id "$TANDA_ORG_ID" '{organizationId: $id}')"

Create the token:

export TANDA_TOKEN="$(curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/api-token" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d '{"name": "ci"}' | jq -r .token)"

Check a token

curl -sS --fail-with-body -X POST "$TANDA_APP/api/auth/validate" \
  -H "Authorization: Bearer $TANDA_TOKEN"

This returns the user and organization the token acts for. A token that’s wrong or revoked gets a 401.

List and revoke tokens

Revoke a token on the Developer page, or from a session. Listing shows each token’s details but never the token itself:

curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/api-token" | jq

curl -sS --fail-with-body -X DELETE -b "$TANDA_JAR" "$TANDA_APP/api/api-token/$TANDA_TOKEN_ID" \
  -H "Origin: $TANDA_APP"

Revoke a token as soon as you think it may have leaked, then create a new one.