Creating a token
1
Open your organization settings
Go to Settings > API. You need to be an owner or an admin.
2
Choose what the token may do
Grant only the scopes the integration needs. A token that only reads events cannot delete one.
3
Choose how long it lasts
Pick 30, 90, 180, or 365 days. The default is 365.
4
Copy the token
It is shown once, at creation, and never again. Store it somewhere your integration can read it and you cannot lose it.
Tokens belong to the organization
A token is not tied to the person who created it. If that admin leaves and their account is removed, the token keeps working and the integration keeps running. The practical consequence: anyone with admin access to the organization can see that a token exists and revoke it. Name your tokens after the integration that uses them, not after yourself.Every token expires
There is no permanent token. The longest life you can choose is a year, and that is also the default. Plan for the renewal rather than discovering it. Create the replacement token, deploy it, then revoke the old one — nothing that uses the old token keeps working past its expiry date, which is shown in Settings > API. An expired token is refused with401, exactly like a revoked one. Your integration cannot tell the difference, and does not need to: both mean “get a new token”.
Expired tokens stay visible in settings for 90 days after they lapse, so there is a record to look at when someone asks why an integration stopped.
Revoking a token
Revoke it in Settings > API. It stops working immediately. Revoke a token the moment you suspect it has leaked — into a git history, a CI log, a screenshot, a pasted snippet. Creating a replacement takes a few seconds.Rate limits
Your limit depends on your plan, and applies per token:
Over that, the API answers
429 with a Retry-After header telling you how many seconds to wait.
Give each integration its own token. Sharing one token across several tools means they share a rate limit, and a busy one can starve the others.