API tokens
Create and manage the tokens your own software carries to talk to Instasent — one per API, scoped to what that integration actually needs, and revocable on the spot.
An API token is the credential your own software carries: your server, your script, your integration calling Instasent directly. Nobody authorizes anything — you create the token, you scope it, and your code holds it. That is what makes it different from a connected app, and it is the only case where you handle a credential yourself.
Where to find them
Open Settings → Developers. The page holds your tokens and the reference documentation for the APIs they open, plus a shortcut that copies the AI-readable index of these docs if you want to hand it to an assistant.
Creating a token
Pick the API
Open the tab for the API your integration will call, then Create token.
Name it so you'll recognise it later
The name is how you'll tell tokens apart when one has to be revoked in a hurry. Name it after the thing that uses it, not after what it does.
Grant only the permissions it needs
A token carries scopes, not a role, so it is limited to specific actions — reading your audience, pushing contacts, sending, and so on. Grant the narrowest set that does the job.
Tie it to its projects
Scope the token to the projects it should reach, and no others.
The exact scopes on offer depend on the API, and they are the same permissions the reference documents endpoint by endpoint — see Authentication for the Product API and HTTP authentication for A2P Messaging.
Managing them
From the list you can disable a token without deleting it — useful when you suspect an integration is misbehaving and don't want to lose its configuration — edit its name, scopes and projects, or delete it, which revokes access immediately and permanently. Anything still using a deleted token stops working at once.
Token or connected app?
The question that settles it is whose software it is.
- Yours — your backend, your script, your automation. That's a token, and this page.
- Somebody else's — an assistant you use, or an app another company built. Then you don't create a credential at all: you authorize it, and it appears in Connected apps. See Connect your AI or Third-party apps.
To push contacts and events into Instasent programmatically, see API & webhooks.