> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clearpolicy.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and use an API token

> Authenticate REST API requests with an organization-scoped API token and revoke tokens that no longer need access.

The REST API uses **API tokens** sent as bearer tokens. A token is tied to the organization selected when it was issued; changing your organization in the app does not retarget that token.

Owners and administrators can create and manage API tokens. The organization needs an active trial or subscription to use the REST API.

## Create an API token

1. Select the organization to connect.
2. Open **Settings → API**.
3. Click **Create API Token** and give it a descriptive name, such as `Reporting automation`.
4. Copy the token when shown. You cannot view the full token again after closing the dialog.
5. Store it in a password manager, secrets manager, or your integration's protected settings.

Do not share tokens in email, support chat, or public code. If token setup fails, [contact support](/guides/get-support) with the error, not the token.

## Pass the token in requests

Send `Authorization: Bearer YOUR_API_TOKEN` and request JSON responses:

```bash theme={null}
curl 'https://api.clearpolicy.app/api/v1/me' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Accept: application/json'
```

Use `GET /me` to confirm the token's organization before sending requests or changing group membership.

## Access by role

The token follows the team member's role. Owners and administrators can use the people, groups, documents, and request endpoints. A token tied to a Group Manager can use `GET /me`, but organization-wide REST endpoints return `403 Forbidden`.

## Error responses

| Status | Check |
| - | - |
| `401 Unauthorized` | The token is present, correct, unexpired, and not revoked. |
| `402 Payment Required` | The token's organization has an active trial or subscription. |
| `403 Forbidden` | The team member and token have permission for the endpoint. |

See [API errors](/api/overview#errors) for other responses.

## Revoke a token

Open **Settings → API** to see active tokens, who issued them, their expiry, and last use. Click **Revoke** when a token is no longer needed or may have been exposed.

Update integrations to use a replacement token before revoking one they still need.

## Zapier and AI connections

[Zapier](/integrations/zapier) and [ChatGPT or Claude](/integrations/mcp) use OAuth sign-in and consent instead of this API-token setup.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.