API keys and tokens

Everything the Online Record Book does for people, your own systems can do too, through one API. API for your systems explains it, and anyone can read it without signing in.

Two kinds of key

• A client is a key for a system, such as a customer database. An Operator admin makes it under API clients, in the console. It acts in the role of the admin who made it, and only does what the permissions you give it allow.
• A personal access token is a key for your own programs. You make it on your profile, under Personal access tokens. It acts as you, in the role you choose, or on your account only.

You cannot make or revoke a token while you are acting as someone else.

Make a key

Choose Make a client or Make a token. Give it a name that says what it is for. For a client, choose What it may do, from the permissions you hold, and the Calls a minute. For a token, choose Acts in and Lasts: 30, 90 or 365 days. Choose Make client or Make token.

Your new key is shown once. Choose Copy key, keep it safe like a password, then choose I have copied it. It cannot be shown again.

Use it

Send the key as a bearer token on every call. A key sees only what its role sees. Every answer carries the rate limit, and a refusal carries a stable code. If someone stops holding the role a key acts in, the key stops too, and you make a new one. Choose Revoke to end a key at once. This cannot be undone.