# Tokens

Every call needs an API token, except `GET /api/v1/openapi.json`.

- Make one on [your account page](https://dudbox.com/account), under "API tokens". Give it a name that says where it is used, like "laptop" or "my agent".
- It starts with `dud_` and has 44 characters. dudbox shows it once and keeps only a hash of it. If you lose it, revoke it and make a new one.
- A token can do what you can do in the dashboard, in your organization. It cannot make or list tokens.
- Revoke a token on the account page. It stops working at once.
- Up to 20 tokens per person.

Send it in the `Authorization` header. The login cookie of the website does not work here.

```sh
curl -s https://dudbox.com/api/v1/me -H "Authorization: Bearer $DUDBOX_TOKEN"
```

Never put a token in a URL, a commit or a log. In CI, keep it in the CI's secret store.

### `GET /api/v1/me`

Shows who the token is: the user, the organization and the token itself. Use it to check a token.

```json
{
  "user": { "id": "Z12s4v6v1PV0…", "name": "Rook", "email": "rook@example.com" },
  "org": { "id": "MAgaX438mUa2…", "name": "Rook" },
  "token": { "id": "tok_4hT9wQ2mXc1L", "name": "my agent" }
}
```

A bad or revoked token gets `401` with `"code": "unauthorized"`.

### `GET /api/v1/openapi.json`

This API as one OpenAPI 3.1 file, for tools that read it. No token needed.

```sh
curl -s https://dudbox.com/api/v1/openapi.json
```