API Tokens - InstaPods

An API token is the credential to use for anything unattended: CI, a deploy script, a cron job. It starts with ipk_, doesn’t expire unless you give it an expiry, and is bound to the team that was active when you created it - so it keeps acting on the same team no matter what you switch to later. Send it as a bearer token:

curl https://app.instapods.com/api/pods \
  -H "Authorization: Bearer ipk_..."

The CLI takes one too - see Authentication.

List Tokens

GET /api/api-tokens

Response: 200 OK

[
  {
    "id": "tok_abc123",
    "user_id": "usr_xyz",
    "team_id": "team_abc",
    "name": "ci",
    "prefix": "ipk_1a2b3c4d",
    "last_used_at": "2026-02-20T09:12:00Z",
    "expires_at": null,
    "created_at": "2026-01-15T10:00:00Z"
  }
]

Metadata only. The token value itself is stored hashed and is never returned again after creation, so there is no endpoint that can show it to you. prefix is the first 12 characters, which is how you match a row in this list against a token you have somewhere. last_used_at is the cheapest way to find a token nothing uses any more.

Create a Token

POST /api/api-tokens

{
  "name": "ci",
  "expires_in_days": 90
}

Field	Type	Required	Description
`name`	string	Yes	A label, max 100 characters
`expires_in_days`	integer	No	Days until expiry, 1-3650. `0` or omitted means it never expires

Response: 201 Created

{
  "id": "tok_abc123",
  "name": "ci",
  "team_id": "team_abc",
  "prefix": "ipk_1a2b3c4d",
  "expires_at": "2026-05-20T10:00:00Z",
  "created_at": "2026-02-20T10:00:00Z",
  "token": "ipk_1a2b3c4d..."
}

token appears in this response and nowhere else, ever. Copy it now. If you lose it, revoke the token and create another - there is no way to recover the value.

Code	Reason
`400`	`name` missing or over 100 characters, or `expires_in_days` outside 0-3650
`403`	You’re calling from a connector (MCP) session - see below

A connector session cannot mint an API token. The OAuth exchange issues a full-power 30-day session, so allowing it would let a stolen connector token be traded for a credential that outlives revoking the session. No MCP client needs to create one. Sign in to the dashboard, or use the CLI (instapods login), which is unaffected.

Revoke a Token

DELETE /api/api-tokens/{id}

Response: 200 OK

{ "status": "deleted" }

Effective immediately: the next request using that token gets a 401. You can only revoke your own tokens (403 otherwise). Revoking an API token does not touch your browser or CLI sessions - those are separate, and are listed and revoked from Account Settings.

​List Tokens

​Create a Token

​Revoke a Token

List Tokens

Create a Token

Revoke a Token