Tokens

Last updated 04 November 2026

Every call needs an API token, except GET /api/v1/openapi.json.

• Make one on your account page ↗, under "API tokens". Give it a name that says where it is used, like "laptop" or "my agent".
• It starts with dud_ and has 44 characters. dudbox shows it once and keeps only a hash of it. If you lose it, revoke it and make a new one.
• A token can do what you can do in the dashboard, in your organization. It cannot make or list tokens.
• Revoke a token on the account page. It stops working at once.
• Up to 20 tokens per person.

Send it in the Authorization header. The login cookie of the website does not work here.

curl -s https://dudbox.com/api/v1/me -H "Authorization: Bearer $DUDBOX_TOKEN"

Never put a token in a URL, a commit or a log. In CI, keep it in the CI's secret store.

GET /api/v1/me

Shows who the token is: the user, the organization and the token itself. Use it to check a token.

{
  "user": { "id": "Z12s4v6v1PV0…", "name": "Rook", "email": "rook@example.com" },
  "org": { "id": "MAgaX438mUa2…", "name": "Rook" },
  "token": { "id": "tok_4hT9wQ2mXc1L", "name": "my agent" }
}

A bad or revoked token gets 401 with "code": "unauthorized".

GET /api/v1/openapi.json

This API as one OpenAPI 3.1 file, for tools that read it. No token needed.

curl -s https://dudbox.com/api/v1/openapi.json