# API tokens

URL: https://getflowing.ai/docs/integrations/api-tokens

Create a personal API token for scripts and continuous integration, keep it safe, and revoke it when you no longer need it.

An API token lets a script, a local tool or a continuous integration job read your workspace through GetFlowing's API, as you, with read-only access.

## Create a token

1. Go to **Settings**, then **Developer**, and find **API tokens**.
2. Choose **Create token**, give it a name that says where it is used, such as `CI / GitHub Actions`, and choose **Create token**.
3. Copy the token. This is the only time GetFlowing shows it.

Send it in the `Authorization` header of each request, as `Bearer` followed by the token.

## What a token can do

A token can read, but it cannot change anything: deploying, approving, changing settings and anything else that changes your workspace needs a person signed in to GetFlowing. A token cannot manage your own account either.

The API's reference and address are not published yet. Until they are, ask on the **Help** page if you need to use a token. See [Get help](https://getflowing.ai/docs/troubleshooting/get-help).

## Keep tokens safe

- Treat a token like a password. Store it as a secret in your CI system, never in a repository.
- Create one token for each place you use it, so you can revoke one without breaking the others.
- Each token shows when it was created and last used. Choose **Revoke** on any you do not recognise or no longer need.
- When someone leaves your team, their tokens are revoked with them.