> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/api-tokens.md).

# API Tokens

Create and revoke project-scoped bearer tokens for programmatic access to the Lleverage REST API.

Control → **API Tokens** creates bearer tokens bound to the current Project for the public REST API.

![The New API Token dialog with a title and the current 30 days, 1 year and Never expiry choices.](https://3370306531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlgSglJDQZxDZdn20CUcl%2Fuploads%2FcDgkJNH2b83tkrksauSH%2Fcontrol-api-token-create.png?alt=media)

The token value is shown once when created. Afterwards the product lists only a masked form. Revocation means deleting the token; there is no separate rotation operation.

### Scope and access

A Project token carries the organisation and Project identity needed to scope API calls. The current Project-token surface does **not** expose per-route scopes: treat a valid Project token as Project-wide API authority rather than as a narrowly scoped credential.

The current Project-token route is **not owner-gated**. An organisation member who can reach the Project can create Project API tokens today. Treat that as the deployed permission boundary rather than assuming only Project Owners or Builders can mint credentials.

Organisation-wide API tokens are not part of the current product surface. Create API credentials from the Project that the integration should access rather than relying on an organisation-level token to create Projects or mint credentials programmatically.

A token remains tied to the current organisation and Project access of the person who created it. If that person leaves the organisation or loses access to the Project, the token is rejected rather than continuing under a fallback role. For long-lived integrations, make token ownership part of the handover when the responsible person changes.

### Expiry

The creation dialog offers **30 days**, **1 year** and **Never**, defaulting to 30 days. Non-expiring Project tokens are therefore a supported current outcome, not merely a legacy state.

For long-lived integrations, keep a record of why the token exists, who owns the integration and how it will be revoked. Do not store the token in ordinary Project files, Skills or Variables.

### Rotation and API behaviour

There is currently no in-place Project-token rotation. Replace a token by creating a new one, updating the consumer and deleting the old token.

Authentication failures intentionally collapse several causes into the same `401 Token is invalid` response, and a resource outside the token's Project is generally returned as `404`. Integrations should not infer detailed authorisation state from those responses.

The public API does not currently provide general idempotency handling. Retrying a state-changing request can repeat the operation, including starting a Workflow again.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.lleverage.ai/administer-and-govern/control/api-tokens.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.