> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instapods.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

> Create and revoke the long-lived ipk_ tokens used for CI and automation.

An API token is the credential to use for anything unattended: CI, a deploy script, a cron job. It
starts with `ipk_`, doesn't expire unless you give it an expiry, and is bound to the team that was
active when you created it - so it keeps acting on the same team no matter what you switch to later.

Send it as a bearer token:

```bash theme={null}
curl https://app.instapods.com/api/pods \
  -H "Authorization: Bearer ipk_..."
```

The CLI takes one too - see [Authentication](/cli/authentication).

## List Tokens

```
GET /api/api-tokens
```

**Response: `200 OK`**

```json theme={null}
[
  {
    "id": "tok_abc123",
    "user_id": "usr_xyz",
    "team_id": "team_abc",
    "name": "ci",
    "prefix": "ipk_1a2b3c4d",
    "last_used_at": "2026-02-20T09:12:00Z",
    "expires_at": null,
    "created_at": "2026-01-15T10:00:00Z"
  }
]
```

Metadata only. The token value itself is stored hashed and is never returned again after creation,
so there is no endpoint that can show it to you.

`prefix` is the first 12 characters, which is how you match a row in this list against a token you
have somewhere. `last_used_at` is the cheapest way to find a token nothing uses any more.

## Create a Token

```
POST /api/api-tokens
```

```json theme={null}
{
  "name": "ci",
  "expires_in_days": 90
}
```

| Field             | Type    | Required | Description                                                      |
| ----------------- | ------- | -------- | ---------------------------------------------------------------- |
| `name`            | string  | Yes      | A label, max 100 characters                                      |
| `expires_in_days` | integer | No       | Days until expiry, 1-3650. `0` or omitted means it never expires |

**Response: `201 Created`**

```json theme={null}
{
  "id": "tok_abc123",
  "name": "ci",
  "team_id": "team_abc",
  "prefix": "ipk_1a2b3c4d",
  "expires_at": "2026-05-20T10:00:00Z",
  "created_at": "2026-02-20T10:00:00Z",
  "token": "ipk_1a2b3c4d..."
}
```

<Warning>
  `token` appears in this response and nowhere else, ever. Copy it now. If you lose it, revoke the
  token and create another - there is no way to recover the value.
</Warning>

| Code  | Reason                                                                     |
| ----- | -------------------------------------------------------------------------- |
| `400` | `name` missing or over 100 characters, or `expires_in_days` outside 0-3650 |
| `403` | You're calling from a connector (MCP) session - see below                  |

<Note>
  A [connector](/mcp/overview) session cannot mint an API token. The OAuth exchange issues a
  full-power 30-day session, so allowing it would let a stolen connector token be traded for a
  credential that outlives revoking the session. No MCP client needs to create one. Sign in to the
  dashboard, or use the CLI (`instapods login`), which is unaffected.
</Note>

## Revoke a Token

```
DELETE /api/api-tokens/{id}
```

**Response: `200 OK`**

```json theme={null}
{ "status": "deleted" }
```

Effective immediately: the next request using that token gets a `401`. You can only revoke your own
tokens (`403` otherwise).

Revoking an API token does not touch your browser or CLI sessions - those are separate, and are
listed and revoked from [Account Settings](/dashboard/account-settings).