> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/api-tokens.md).

# API tokens

Create and revoke project-scoped bearer tokens for programmatic access to the Lleverage REST API.

Control → **API Tokens** creates bearer tokens bound to the current Project for the public REST API.

![The New API Token dialog with a title and the current 30 days, 1 year and Never expiry choices.](https://3370306531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlgSglJDQZxDZdn20CUcl%2Fuploads%2FcDgkJNH2b83tkrksauSH%2Fcontrol-api-token-create.png?alt=media)

The token value is shown once when created. Afterwards the product lists only a masked form. Revocation means deleting the token; there is no separate rotation operation.

### Scope and access

A Project token carries the organisation and Project identity needed to scope API calls. The current Project-token surface does **not** expose per-route scopes: treat a valid Project token as Project-wide API authority rather than as a narrowly scoped credential.

The current Project-token route is **not owner-gated**. An organisation member who can reach the Project can create Project API tokens today. Treat that as the deployed permission boundary rather than assuming only Project Owners or Builders can mint credentials.

Organisation-wide API tokens are not part of the current product surface. Create API credentials from the Project that the integration should access rather than relying on an organisation-level token to create Projects or mint credentials programmatically.

A token remains tied to the current organisation and Project access of the person who created it. If that person leaves the organisation or loses access to the Project, the token is rejected rather than continuing under a fallback role. For long-lived integrations, make token ownership part of the handover when the responsible person changes.

### Expiry

The creation dialog offers **30 days**, **1 year** and **Never**, defaulting to 30 days. Non-expiring Project tokens are therefore a supported current outcome, not merely a legacy state.

For long-lived integrations, keep a record of why the token exists, who owns the integration and how it will be revoked. Do not store the token in ordinary Project files, Skills or Variables.

### Rotation and API behaviour

There is currently no in-place Project-token rotation. Replace a token by creating a new one, updating the consumer and deleting the old token.

Authentication failures intentionally collapse several causes into the same `401 Token is invalid` response, and a resource outside the token's Project is generally returned as `404`. Integrations should not infer detailed authorisation state from those responses.

The public API does not currently provide general idempotency handling. Retrying a state-changing request can repeat the operation, including starting a Workflow again.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.lleverage.ai/administer-and-govern/control/api-tokens.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.