---
title: "API Tokens"
description: "Create, use and revoke the tokens that sign in to the REST API"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.testandaccept.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

An API token starts with `tnda_` and signs in to the REST API. Send it on every request:

```bash
curl -sS https://api.testandaccept.com/api/rest/projects \
  -H "Authorization: Bearer $TANDA_TOKEN"
```

Tokens don't work on the MCP server, which uses [OAuth sign-in](/integrations/mcp-setup/).

## What a token can do

- **It acts as you.** It has your access in its organization, and there are no narrower scopes.
- **It belongs to one organization.** That's whichever was active when it was made. To work in another organization, create another token.
- **It doesn't expire.** It keeps working until you revoke it.
- **It can't manage tokens or organizations.** Creating and revoking tokens, creating organizations and accepting organization invitations all need a signed-in session.

## Create a token in the app

1. Sign in and choose the organization.
2. Open [Developer](https://www.testandaccept.com/developer).
3. Create a token, and copy it straight away. It's only shown once.

Use this if you sign in with Google, GitHub or Microsoft, or use two-factor authentication.

## Create a token from a terminal

You need a session first. This signs in with your password and keeps the session in a cookie file:

```bash
export TANDA_APP=https://www.testandaccept.com
export TANDA_JAR="$(mktemp)"

curl -sS --fail-with-body -o /dev/null -b "$TANDA_JAR" -c "$TANDA_JAR" \
  "$TANDA_APP/api/auth/sign-in/email" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d "$(jq -n --arg email "$TANDA_EMAIL" --arg password "$TANDA_PASSWORD" \
    '{email: $email, password: $password}')"
```

Choose the organization. `/api/organizations` lists yours:

```bash
curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/organizations" | jq

curl -sS --fail-with-body -o /dev/null -b "$TANDA_JAR" -c "$TANDA_JAR" \
  "$TANDA_APP/api/auth/organization/set-active" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d "$(jq -n --arg id "$TANDA_ORG_ID" '{organizationId: $id}')"
```

Create the token:

```bash
export TANDA_TOKEN="$(curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/api-token" \
  -H "Origin: $TANDA_APP" -H 'Content-Type: application/json' \
  -d '{"name": "ci"}' | jq -r .token)"
```

## Check a token

```bash
curl -sS --fail-with-body -X POST "$TANDA_APP/api/auth/validate" \
  -H "Authorization: Bearer $TANDA_TOKEN"
```

This returns the user and organization the token acts for. A token that's wrong or revoked gets a `401`.

## List and revoke tokens

Revoke a token on the Developer page, or from a session. Listing shows each token's details but never the token itself:

```bash
curl -sS --fail-with-body -b "$TANDA_JAR" "$TANDA_APP/api/api-token" | jq

curl -sS --fail-with-body -X DELETE -b "$TANDA_JAR" "$TANDA_APP/api/api-token/$TANDA_TOKEN_ID" \
  -H "Origin: $TANDA_APP"
```

Revoke a token as soon as you think it may have leaked, then create a new one.

Source: https://docs.testandaccept.com/agents/api-tokens/index.mdx