Create an API token

Step 1 Open API tokens

Click Workspace in the sidebar to open the Account page, then choose API tokens in the menu on the left. The table lists your tokens with their access, expiry date and when each was last used.

Step 2 Name the token and pick an expiry

Click Create token. Enter a Name that says where the token will be used, for example “Deployment automation”.

Choose Expires after: 30 days, 90 days, 1 year or Never. The default is 90 days. A token set to Never works until you revoke it, so prefer a shorter expiry and create a new token when it runs out.

Step 3 Choose what the token can access

Under Access, set each area to No access, View or View and manage:

• Servers: provisioning, reboots, firewall, updates.
• Sites & applications: deploys, SSL, environment variables, settings.
• Domains: custom domains on sites.
• Integrations: Git, cloud provider and storage connections.

When Sites & applications is set to View and manage, two more switches appear. They are off unless you turn them on:

• Secrets and files: read environment variables and database passwords, open and change site files, sign in to WordPress.
• Delete sites: remove sites and everything on them.

Give the token only what the script needs. A token also never gets more access than you have yourself.

Step 4 Copy the token

Click Create token.

The window then shows the token. Click the copy button and store it somewhere safe, such as your tool’s secret settings. The token is shown only once; if you lose it, revoke it and create a new one.

Send the token with each request in the Authorization header:

Authorization: Bearer nuvlo_…