Create a token
1
Open the API tokens card in Settings
Sign in first. A token belongs to your account.
2
Name it after what will use it
A name such as
backup-script or laptop-mcp makes revoking the right one possible later.3
Choose a scope and an expiry
Read only is the default and is all the MCP server or a reporting script needs. Choose read and write only for something that has to change data. An expiry of 30, 90 or 365 days beats a permanent credential sitting in a continuous integration configuration.
4
Copy the value immediately
The plaintext value, which starts with
asob_, is shown once. asobeast stores only a SHA-256 hash of it and can never show it again.Scope and expiry
The tokens card shows each token’s scope, expiry, last use and request count, so the one consuming your budget is easy to find.
Use a token
Send it as a bearer header on every request./api/backend/* on the web origin is the same proxy the browser uses, and it forwards the bearer header to the API. When your script runs on the same host as the API, you can call the API directly instead.
Revoke a token
Delete it from the same card. Revocation is immediate: the next request carrying that token fails authentication. Rate limits count per workspace rather than per token, so a second token adds no capacity and revoking one does not free any. See Rate limits and quotas. Revoke rather than rotateAUTH_SECRET when a single token leaks. Rotating the secret signs out every browser session and does not affect tokens at all, because tokens are hashes rather than signed values.
Where tokens are used
Related
Authentication and accounts
How a request is authenticated and authorized.
The queue dashboard and the OpenAPI surface
What an owner token unlocks.