Developers · 02
Authentication
Bearer token on every request. Minted in Admin → Integrations, shown once.
Header
Authorization: Bearer ptk_live_…The token is tied to one organisation. Scopes on the token decide which collections it can read. See Scopes.
Create and rotate
Admin → Integrations → API tokens → New token. Name it, pick scopes, optionally bind it to a marketplace listing.
The full value is shown once. Prototype stores a SHA-256 hash. Lost it → mint a new one and revoke the old.
Revoke is immediate: subsequent calls return 401 invalid_token. Mint the replacement first, switch your process over, then revoke.
Storing the token
Keep ptk_live_… in an environment variable or a secret manager. Do not commit it, log the whole value, or paste it into a marketplace listing.
One token per integration is easier to revoke. Grant only the scopes that integration uses.