> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arct.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

> Create, turn off and delete tokens for the Arct Cloud API.

An API token lets an app, script or service authenticate with the [Arct Cloud API](/api-reference/introduction.md). It grants access to your account, so treat it like a password. Go to **Settings** > **API Tokens** in the dashboard to manage your tokens.

If **API Tokens** isn't listed under **Settings**, the API isn't turned on for your account yet. Contact [support](/account/support-tickets.md) to ask for access.

## Create a Token

**1. Open API Tokens**

Go to **Settings** > **API Tokens** and click **Create token**.

**2. Name the Token**

Enter a name you'll recognize, such as `CI deploys`. Use up to 64 letters, digits, spaces, `-`, `_` and `.`.

**3. Choose the Access**

* **Read only**: view servers, SSH keys, invoices and the catalog.
* **Read & write**: also create, change, power, reinstall, resize and delete servers. Creating and resizing servers charges your default card.

Choose **Read only** when a tool only needs to look.

**4. Choose When It Expires**

Pick **Never**, **30 days**, **90 days** or **1 year** from the **Expires** menu. It starts on **Never**.

**5. Copy the Token**

Click **Create token**, copy the token, then click **Done**. It starts with `arct_`.

> [!WARNING]
>
> The token is shown only once. Copy it now and keep it in a secret manager. Anyone with the token can use your account through the API.

You can have up to 10 tokens, including ones that are turned off or expired. Delete tokens you no longer use to make room.

## Token Created Email

Each time a token is created, we email the account owner. The email shows the token's name, access, expiry, when it was created (in UTC) and the IP address it was created from. It never contains the token itself.

If you didn't create the token, delete it in **Settings** > **API Tokens** and [change your password](/account/security.md#password).

## View Your Tokens

**Settings** > **API Tokens** lists each token with:

* its name, with the first 12 characters of the token under it;
* its **Access**: **Read only** or **Read & write**, both in the same gray badge;
* an **Enabled** switch;
* when it **Expires**;
* when it was **Last used** (updated at most once a minute);
* when it was **Created**.

## Turn a Token Off or On

Use the **Enabled** switch next to a token. A token that is off stops working right away, and turning it back on restores it. This is useful to check that nothing still uses a token before you delete it.

## Rename a Token

Click **Rename** next to the token, enter the new name, and click **Save**.

## Delete a Token

1. Click **Delete** next to the token
2. Click **Delete token** in the dialog

Scripts using the token stop working right away. A deleted token can't be restored.

## Token Activity

Go to **Settings** > **Activity Log** and open the **API** tab. It shows when tokens were created, changed and deleted, and the changes made through the API, with the name of the token that made them.

> [!TIP]
>
> If you see API activity you don't recognize, turn the token off, then [secure your account](/account/security.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.