--- title: "What are API tokens?" description: "Learn what API tokens are in Linkbreakers and how they enable public API access, the SDKs and the CLI, custom dashboards, white label solutions, and programmatic automation. The MCP server uses OAuth instead." canonical: "https://linkbreakers.com/help/article/what-are-api-tokens" last-updated: 2026-10-24 --- # What are API tokens? > Learn what API tokens are in Linkbreakers and how they enable public API access, the SDKs and the CLI, custom dashboards, white label solutions, and programmatic automation. The MCP server uses OAuth instead. API tokens in Linkbreakers are secure authentication credentials that provide programmatic access to your [workspace](https://linkbreakers.com/help/article/what-is-a-workspace). They enable API integration through the REST API, the SDKs and the CLI, custom dashboard development, and [white label solutions](https://linkbreakers.com/help/article/how-to-use-white-label-in-linkbreakers). AI assistants connect through the [MCP server](https://linkbreakers.com/help/article/how-to-set-up-and-configure-the-linkbreakers-mcp-server), which signs in with OAuth and does not accept API tokens. Tokens use JWT-based authentication and remain valid until explicitly revoked. A workspace can have multiple tokens for different purposes (production, development, analytics, white label). Linkbreakers offers two token types: [secret keys for backend use and publishable keys for frontend applications](/help/article/secret-key-vs-publishable-key). ## Quick summary - Understand that API tokens authenticate programmatic access to your [workspace](https://linkbreakers.com/help/article/what-is-a-workspace) - Create tokens through the workspace dashboard with descriptive names for different use cases - AI assistants like Claude connect to the [MCP server](https://linkbreakers.com/help/article/how-to-set-up-and-configure-the-linkbreakers-mcp-server) with OAuth, not with an API token - Call the [public REST API](https://linkbreakers.com/help/article/how-to-use-the-linkbreakers-api) to automate [link](https://linkbreakers.com/help/article/whats-a-link) creation, analytics retrieval, and [workflow](https://linkbreakers.com/help/article/what-is-a-workflow-in-linkbreakers-and-how-it-powers-automation) management - Build custom dashboards and [white label solutions](https://linkbreakers.com/help/article/how-to-use-white-label-in-linkbreakers) with complete control over user experience - Manage token security through rotation, revocation, and environment-based isolation ## How to create an API token Creating an API token takes just a few seconds: 1. Navigate to [**Dashboard → API Tokens**](https://app.linkbreakers.com/workspace/dashboard/api-tokens) 2. Click **"Create API Token"** 3. Enter a descriptive name that identifies the token's purpose (e.g., "Production API", "Development", "Nightly CLI export", or "Analytics Dashboard") 4. Under **Access**, keep **Full access** or choose **Restricted** and pick only the resources the token needs (see [API token scopes](/help/article/api-token-scopes)) 5. Click **"Create"** 6. **Copy the JWT token immediately** - it's only shown once for security reasons The token will look like a long string starting with `eyJ...` - this is a JWT (JSON Web Token) containing your workspace ID and permissions. Store it securely in environment variables or a password manager. **Important:** Never commit tokens to source code or share them publicly. If a token is exposed, revoke it immediately from the same dashboard and create a new one. ## Understanding token types: Secret vs Publishable keys Linkbreakers provides two types of API tokens with different permission levels: **Secret keys** provide full API access and must only be used in backend environments: - Create, update, and delete links - Access analytics and workspace metrics - Manage all workspace resources - ❌ **Never expose in frontend code** **Publishable keys** are frontend-safe with limited permissions: - Identify visitors and update visitor profiles - Read limited visitor data - ✅ **Safe to use in browser/mobile apps** - ❌ Cannot create links or access analytics **When creating a token**, choose the appropriate type based on where it will be used. For a detailed comparison of capabilities and security best practices, see [Secret Key vs Publishable Key](/help/article/secret-key-vs-publishable-key). ## What are API tokens used for? API tokens unlock programmatic access to your Linkbreakers workspace, enabling automation and integration scenarios that would be tedious or impossible through the web interface. ### API tokens vs user passwords | Feature | User Passwords | API Tokens | |----------------------------|-------------------------|-------------------------| | Purpose | Human authentication | Machine authentication | | Validity | Permanent | Until revoked | | Can be shared | No | Yes (with applications)| | Revocable independently | No | Yes | | Works with automation | No | Yes | | Storage location | User's memory | Environment variables | | Audit trails | Basic | Detailed usage logs | API tokens use JWT-based authentication and provide workspace-scoped access. Unlike passwords, tokens are designed for machine-to-machine communication and can be safely stored in secure environments like password managers, environment variables, or secret management services. ### Token use cases A single [workspace](https://linkbreakers.com/help/article/what-is-a-workspace) can have multiple tokens for different purposes: | Token Type | Purpose | Best Practice | |---------------------|--------------------------------------------|----------------------------------------| | MCP integration | Not a token use: the MCP server accepts OAuth only | Connect with OAuth | | Production API | Live application integrations | Rotate quarterly | | Development | Testing and staging environments | Separate from production | | Analytics | Business intelligence dashboards | Read-only operations recommended | | White label | Custom-branded customer solutions | One per customer tenant | This multi-token approach enables proper security isolation and usage tracking across different integration scenarios. ## Using OAuth with the MCP server The [Linkbreakers MCP server](https://linkbreakers.com/help/article/how-to-set-up-and-configure-the-linkbreakers-mcp-server) enables AI assistants to interact with your workspace using natural language. The MCP server authenticates with OAuth 2.0 and does not accept API tokens: a client that sends one gets `API tokens are not accepted by the MCP server; connect with OAuth`. Your MCP client handles sign-in automatically when you first connect, so there is nothing to paste. ### Natural language interactions With an MCP-connected client, you can simply ask AI assistants to: - "Create a shortened link for my new product launch" - "Show me analytics for all links created this month" - "Generate a QR code design with my brand colors" - "List visitors who submitted the contact form" The MCP server translates these natural language requests into API calls, handles authentication via OAuth, and returns results in conversational format. ### Supported AI assistants OAuth-based MCP integration works with: - **Claude** (web and desktop app via Connectors) - **Claude Code** (CLI tool for development workflows) - **Continue** (VSCode extension for coding assistance) - **Any MCP-compatible client** following the Model Context Protocol standard This provides consistent access across different tools while maintaining centralized authentication and security. API tokens are for the REST API, the SDKs and the CLI; MCP clients need no token configuration. ## Using tokens with the public API The [Linkbreakers REST API](https://linkbreakers.com/help/article/how-to-use-the-linkbreakers-api) provides programmatic access to all platform features through standard HTTP requests. ### API authentication Include your token in the Authorization header for every API request: ```bash curl -H "Authorization: Bearer YOUR_JWT_TOKEN" \ -H "Content-Type: application/json" \ https://api.linkbreakers.com/v1/links ``` This bearer token authentication follows OAuth 2.0 standards and works with any HTTP client in any programming language. ### Common API operations API tokens enable comprehensive platform automation: - **[Link](https://linkbreakers.com/help/article/whats-a-link) management** creating, updating, and deleting links programmatically - **Analytics retrieval** fetching scan data, [visitor profiles](https://linkbreakers.com/help/article/what-is-a-visitor-in-qr-analytics-and-why-it-matters), [visitor journeys](https://linkbreakers.com/help/article/what-is-a-visitor-journey), and performance metrics - **[QR code](https://linkbreakers.com/help/article/how-do-qr-codes-work) generation** creating [custom-designed QR codes](https://linkbreakers.com/help/article/whats-a-qr-code-design) with branding - **[Workflow](https://linkbreakers.com/help/article/what-is-a-workflow-in-linkbreakers-and-how-it-powers-automation) automation** configuring forms, conditional logic, and multi-step sequences - **Domain management** adding custom domains and SSL certificates - **[Webhook](https://linkbreakers.com/help/article/how-do-webhooks-work-in-linkbreakers) configuration** setting up real-time event notifications Full API documentation is available at [https://linkbreakers.com/help/api](https://linkbreakers.com/help/api) with comprehensive endpoint references and code examples. ### SDK and library support Official and community libraries simplify API integration: - **Official SDKs** providing typed interfaces for popular languages - **OpenAPI specification** enabling automatic client generation - **Code examples** demonstrating common integration patterns - **Webhook handlers** for processing real-time events These libraries handle authentication, error handling, and response parsing automatically, reducing integration complexity. ## Building custom dashboards API tokens enable complete recreation of Linkbreakers functionality within your own applications. ### Dashboard recreation Build custom interfaces that replicate or extend platform features: - **[Link](https://linkbreakers.com/help/article/whats-a-link) management interfaces** with custom filtering and organization - **Analytics dashboards** combining Linkbreakers data with other metrics - **Custom reporting** using tools like [Tableau](https://linkbreakers.com/help/article/tableau-qr-code-analytics-integration), [Power BI](https://linkbreakers.com/help/article/power-bi-qr-code-dashboard-automation), or Grafana - **Mobile applications** providing on-the-go access to campaign data - **Team-specific views** showing only relevant campaigns and metrics API access provides the data foundation while you control presentation and user experience. ### Real-time data synchronization Keep custom dashboards current through: - **[Webhook](https://linkbreakers.com/help/article/how-do-webhooks-work-in-linkbreakers) notifications** triggering immediate updates when [events](https://linkbreakers.com/help/article/what-are-events-in-linkbreakers) occur - **Polling strategies** fetching fresh data at appropriate intervals - **Caching layers** balancing performance with data freshness - **Event streaming** processing scan data as it arrives This ensures custom interfaces maintain parity with the main platform while optimizing for specific use cases. ## White label and reseller solutions Enterprise plans enable [white label implementations](https://linkbreakers.com/help/article/how-to-use-white-label-in-linkbreakers) where API tokens power completely branded customer experiences. ### Complete brand control Use API tokens to build custom-branded [QR code](https://linkbreakers.com/help/article/how-do-qr-codes-work) platforms: - **Custom domains** ensuring your brand appears throughout the visitor journey - **Branded interfaces** replacing Linkbreakers UI with your own application - **Multi-tenant isolation** managing multiple customers from a single [workspace](https://linkbreakers.com/help/article/what-is-a-workspace) - **Usage-based billing** tracking consumption per customer for reseller pricing Your customers never see the Linkbreakers brand - they experience your solution powered by enterprise infrastructure. ### Custom feature development Build specialized features on top of the platform: - **Industry-specific [workflows](https://linkbreakers.com/help/article/what-is-a-workflow-in-linkbreakers-and-how-it-powers-automation)** tailored to unique business requirements - **Custom integrations** connecting with proprietary systems or platforms like [Zapier](https://linkbreakers.com/help/article/automate-your-lead-generation-with-qr-codes-zapier) and [Make.com](https://linkbreakers.com/help/article/advanced-qr-code-workflows-with-make-com) - **Enhanced [analytics](https://linkbreakers.com/help/article/analytics)** combining scan data with domain-specific metrics - **Specialized exports** formatting data for existing business processes API access provides building blocks while you create differentiated value for your market. For comprehensive integration guidance, see [How to integrate Linkbreakers with existing tech stack](https://linkbreakers.com/help/article/how-to-integrate-linkbreakers-with-existing-tech-stack). ## Token management and security Proper token management ensures secure access while maintaining operational flexibility. ### Creating tokens For detailed token creation steps with video walkthrough, see [How to create an API token](#how-to-create-an-api-token) at the top of this article. **Key tips for token creation:** - Use descriptive names that identify the token's purpose and location (e.g., "Production API - EU Server" or "CLI - John's Mac") - Create separate tokens for different environments (development, staging, production) - Create separate tokens for different team members or applications for easier tracking and revocation ### Security best practices Protect tokens like passwords: - **Never commit tokens to source code** or version control - **Use environment variables** to store tokens securely - **Rotate tokens periodically** even if not compromised - **Revoke unused tokens** immediately to minimize exposure - **Use different tokens** for different environments and purposes The dashboard tracks token usage patterns, enabling detection of unusual activity or compromised credentials. ### Token revocation Immediately revoke tokens if: - An environment is decommissioned - A developer leaves the team - Token appears in logs or version control - Suspicious usage patterns are detected Revocation is instant and irreversible. Dependent integrations will fail immediately, so coordinate revocation with replacement token deployment. ## Frequently Asked Questions ### What's the difference between API tokens and user passwords? API tokens are designed for programmatic access by applications and scripts, while passwords authenticate human users. Tokens can be revoked independently without affecting account access. ### Can I create multiple tokens for the same workspace? Yes. Create as many tokens as needed for different purposes, environments, or applications. This enables proper security isolation and usage tracking. See [What is a workspace?](https://linkbreakers.com/help/article/what-is-a-workspace) for more details about workspace management. ### Do API tokens expire automatically? No. Tokens remain valid indefinitely until explicitly revoked. However, periodic rotation is recommended as a security best practice. ### What happens if my token is compromised? Immediately revoke the token through the dashboard. Generate a new token and update applications. Monitor recent activity for unauthorized access. ### Can I restrict what a token can access? Currently, tokens provide full [workspace](https://linkbreakers.com/help/article/what-is-a-workspace) access. Use different workspaces or careful implementation patterns to segment access by purpose or team. For user-level permissions, see [role-based access control](https://linkbreakers.com/help/article/what-is-role-based-access-control-in-linkbreakers). ### How do I authenticate the MCP server? The MCP server uses OAuth 2.0 and does not accept API tokens. Your MCP client handles sign-in automatically when you connect. Follow the [MCP server setup guide](https://linkbreakers.com/help/article/how-to-set-up-and-configure-the-linkbreakers-mcp-server) for client configuration details. ### What rate limits apply to API token usage? Rate limits vary by plan tier and are designed to accommodate normal usage while preventing abuse. Enterprise plans offer higher limits and can request custom quotas. ### Can I see which token was used for each API call? Yes. The dashboard tracks token usage patterns including request counts and timestamps, enabling security auditing and usage analysis. ### How do tokens work with white label solutions? Enterprise tokens enable complete API access for building custom-branded interfaces and managing multiple customers through a single workspace. ### What's the best way to store tokens in production? Use secure environment variables, secret management services (AWS Secrets Manager, HashiCorp Vault), or container orchestration secrets rather than hardcoding in application code. ## Limits and caveats - Feature availability and limits can vary by plan and workspace setup. - Results depend on correct implementation, attribution setup, and data quality controls. - Regulatory and privacy obligations vary by jurisdiction and use case.