# API tokens

Create and manage the tokens your own software carries to talk to Instasent — one per API, scoped to what that integration actually needs, and revocable on the spot.

**Language:** en
**Audience:** platform
**TLDR:** API tokens are the credential your own code carries. You create them in Settings > Developers, which has one tab per API: Product API and A2P Messaging API. They are different APIs with different tokens, and a token from one does not work on the other. A token carries scopes and is tied to the projects it can reach, so grant only what that integration needs. Tokens are shown once at creation, can be disabled without deleting, and deleting one revokes it immediately. If instead you want to connect an assistant or somebody else's app, that is a connected app over OAuth, not a token.
**Translation key:** platform.developers-and-apps.api-tokens
**Search keywords:** api token, api tokens, token, tokens, api key, create token, scope, scopes, permissions, revoke, delete token, integration, product api, a2p messaging api, http, smpp
**Related pages:** /platform/es/developers-and-apps/api-tokens, /platform/en/developers-and-apps, /platform/en/data-sources/api-webhooks, /developers/product-api/authentication
**Docs index (every page):** https://docs.instasent.com/llms.txt
**This zone's index:** https://docs.instasent.com/platform/en/llms.txt
**This page:** https://docs.instasent.com/platform/en/developers-and-apps/api-tokens/ (HTML) · https://docs.instasent.com/platform/en/developers-and-apps/api-tokens.md (Markdown)
**Other language (es):** https://docs.instasent.com/platform/es/developers-and-apps/api-tokens.md

An API token is the credential **your own software** carries: your server, your
script, your integration calling Instasent directly. Nobody authorizes anything
— you create the token, you scope it, and your code holds it. That is what makes
it different from a connected app, and it is the only case where you handle a
credential yourself.

## Where to find them

Open **Settings → Developers**. The page holds your tokens and the reference
documentation for the APIs they open, plus a shortcut that copies the
AI-readable index of these docs if you want to hand it to an assistant.

![The Developers screen, with the Product API and A2P Messaging API tabs and the empty token list](/platform/en/developers-and-apps/images/api-tokens--1-list.png)
*Settings → Developers: one tab per API, each with its own tokens.*

> **Warning**: **There are two tabs, and they are two different APIs.** *Product API* is the
> customer-data side — audience, contacts, events, segments, campaigns. *A2P
> Messaging API* is raw SMS delivery. Tokens, data shapes and scopes **do not
> transfer between them**: a token created on one tab simply will not work on
> the other. Picking the wrong one is the expensive mistake here, so if you are
> not sure which API your integration needs, start from
> [Choose your API](/developers/getting-started/choose-your-api).

## Creating a token

#### 1. Pick the API

Open the tab for the API your integration will call, then **Create token**.

#### 2. Name it so you'll recognise it later

The name is how you'll tell tokens apart when one has to be revoked in a
hurry. Name it after the thing that uses it, not after what it does.

#### 3. Grant only the permissions it needs

A token carries **scopes**, not a role, so it is limited to specific
actions — reading your audience, pushing contacts, sending, and so on.
Grant the narrowest set that does the job.

#### 4. Tie it to its projects

Scope the token to the projects it should reach, and no others.

> **Warning**: **A token is shown once, at creation.** Copy it then. And treat it like a
> password: anyone holding it can act on your account within its scopes. If one
> is ever exposed, delete it immediately and create a new one — deleting revokes
> it on the spot.

The exact scopes on offer depend on the API, and they are the same permissions
the reference documents endpoint by endpoint — see
[Authentication](/developers/product-api/authentication) for the Product API and
[HTTP authentication](/developers/transactional-api/http/authentication) for A2P
Messaging.

## Managing them

From the list you can **disable** a token without deleting it — useful when you
suspect an integration is misbehaving and don't want to lose its configuration —
**edit** its name, scopes and projects, or **delete** it, which revokes access
immediately and permanently. Anything still using a deleted token stops working
at once.

## Token or connected app?

The question that settles it is **whose software it is**.

- **Yours** — your backend, your script, your automation. That's a token, and
  this page.
- **Somebody else's** — an assistant you use, or an app another company built.
  Then you don't create a credential at all: you **authorize** it, and it
  appears in
  [Connected apps](/platform/en/developers-and-apps/managing-connected-apps).
  See [Connect your AI](/platform/en/developers-and-apps/connect-your-ai) or
  [Third-party apps](/platform/en/developers-and-apps/third-party-apps).

To push contacts and events into Instasent programmatically, see
[API & webhooks](/platform/en/data-sources/api-webhooks).

---

This is one page of the Instasent documentation. For the complete machine-readable index of every guide and API reference, fetch https://docs.instasent.com/llms.txt — start there for full context.