API Token
Definition
An API token, also called an API key or an access token, is generated by the service and shown to you once. It is typically a long random string, sometimes with a short prefix marking what kind of token it is, and it travels in an Authorization header on every request. Tokens differ from passwords in three useful ways: you can hold several at a time, each can be restricted to particular actions, and any one of them can be revoked without disturbing the others. Some last until revoked; others expire after a set period or have to be refreshed. A token is a bearer credential, meaning whoever holds it is treated as you — there is no second factor sitting behind it.
Why It Matters
Because it is a bearer credential, a leaked token is an account handed over. The usual leak is not an attack at all: it is a token committed to a repository, pasted into a chat, or hard-coded into a page that then goes public, where anyone reading the source can lift it. Scoping limits the damage, since a token allowed only to upload files cannot delete your sites or read your billing details. Rotation limits it further — replace tokens on a schedule and an old copy in someone's shell history stops being worth anything. Revoking takes seconds, so the right response to a suspected leak is to revoke first and investigate afterwards.
How It Works
You create a token in the service's dashboard, choose its scope and lifetime, and copy it immediately, because a well-built service stores only a hash and genuinely cannot show it to you again. Your script reads it from an environment variable or a secrets manager rather than from the source file. Each request carries it as Authorization: Bearer followed by the value, sent over HTTPS so it is encrypted in transit and never exposed on the wire. The server hashes what arrives, looks it up, and either proceeds or answers 401. Revoke a token and every request using it fails from the next call onwards; there is no propagation delay to wait through.
Real-World Example
A developer writes a five-line deploy script for a set of generated pages, keeping the token in an environment variable and posting the files to the hosting REST API. She scopes it to uploads only, so a lost laptop cannot become a deleted site. Months later she moves to a new machine, revokes the old token and issues a fresh one, and the pages at docs.99helpers.site carry on serving throughout, because a token controls writing rather than reading.
Common Mistakes
- ✕Hard-coding a token into a front-end file — the browser downloads that file, so the token is public the moment the page is
- ✕Using one all-powerful token everywhere, which turns a single leak into a rotation of everything at once
- ✕Keeping the only copy in a chat message or on a sticky note instead of a password manager, leaving no safe way to hand it to a colleague
Related Terms
REST API
A way of exposing a service over HTTP where each thing you can act on has its own URL, and the HTTP method says what you are doing to it. GET reads, POST creates, PUT replaces, DELETE removes.
Webhook
An HTTP request a service sends to a URL you provide when something happens on its side. Instead of you asking repeatedly whether an event has occurred, it tells you once, immediately.
Two-Factor Authentication
Requiring a second proof of identity alongside the password, so that a stolen password on its own is not enough to get in. The second proof is usually a code from an app or a key held on a device.
Access Control
The rules deciding who may reach a file or page and what they may do once they are there. It combines proving identity with checking permission, and the two are separate jobs.
Presigned URL
A presigned URL is a link to a private stored object that carries its own authorisation in the query string. Anyone holding the link can perform the one operation it was signed for, on the one object it names, until it expires.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →