Authentication

Create a token in Team settings → API tokens. It is shown once.

Authorization: Bearer npat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Every request needs one. A request without a usable token is refused 401 before anything else is looked at, and a token is the only credential these endpoints accept — a session cookie from the app will not do, and neither will any other kind of bearer token.

What a token is

A token belongs to the person who created it and is pinned to one team. It can never do more than that person can: if they lose access to something, so does the token, on the very next request. Nothing has to go and revoke it.

Tokens are read-only today. There is no scope that changes anything.

Scope	What it reads
team:read	The team, its folders, and which documents are in them
document:read	Documents, as JSON, and exported files

Each endpoint names the scope it needs in the reference. A token missing that scope is refused 403, in words that say which scope was wanted.

A public document owned by another team is refused too, even though anyone can open it in a browser. A token is a key to one team, not a browser.

Trying it here

The reference runs requests against your own team from your own browser. Paste a token into its auth panel and any endpoint on the page becomes something you can execute and read the real answer to.

Two things worth knowing about how that works:

• Your token is not stored. It lives as long as the browser tab does and is never written to local storage.
• Your token goes to app.nodepen.io and nowhere else. The request is made by your browser directly against the API — it does not pass through this docs site, and it does not pass through any third-party proxy.

A token pasted here is still a real credential. Prefer one minted for the purpose, and revoke it when you are done.

Revoking

Revoking deletes the token. There is no expiry to wait for and no grace period: the next request carrying it is refused 401, in the same words as a request carrying nothing at all.

You can hold 20 tokens for a team. Revoke one to make room.