Create a named API token with its own access level and expiry, then revoke it later without touching any of your other integrations.
Before you start:
- Your account needs API access switched on. Without it, tokens are refused with a 406 error. An admin enables it under Settings > API.
- You need the Can manage API tokens permission. Account admins have it by default. If you don't, you'll see a Request access button that emails your account's admins.
Create a Token
- Go to My Profile > API tokens.
- Click Add API Token.
- Enter a Name that says what the token is for, such as "Nightly sync".
- Choose the access level: Read only or Read and write.
- Choose an expiry: 30 days, 90 days, 180 days, 1 year, or never. The default is 90 days.
- Click Create.
- Copy the token and store it somewhere safe.
The full token appears once, right after you create it. If you lose it, revoke it and create a new one — there's no way to see it again.
Choose the Right Access Level
Access level
What it can do
Good for
Read only
Read requests only
Reporting, analytics, and dashboards where nothing should ever change
Read and write
Read, plus create and update data
Two-way syncs and anything that writes back to Pipeline CRM
The access level is fixed when you create the token, so pick it up front. If your needs change, create a second token. There are no per-record-type scopes — the choice applies across the whole API.
Send Your Token With a Request
Send the token as a bearer token in the Authorization header. It's a header-only credential; there's no query parameter option. Production tokens begin with pcrm_live_.
Authorization: Bearer pcrm_live_your_token_here
Run Several Tokens at Once
You can keep up to 20 active tokens per user — one per app, script, or teammate. Revoked tokens don't count toward the limit.
Giving each integration its own token is the point: when you revoke one, it stops working immediately and the others carry on untouched.
Revoke a Token
- Go to My Profile > API tokens.
- Find the token you want to stop.
- Click Revoke.
Revocation takes effect immediately.
Oversee Tokens Across the Account
Admins get a full view of every token in the account under Settings > API > API Tokens. The list shows each token's owner, name, access level, status, when it was last used, and its expiry. It defaults to active and expiring tokens, ordered by least recently used, so credentials nobody is using rise to the top.
Admins can revoke any token in the account at any time.
Admins can't see a token's value and can't create a token on someone else's behalf. A token always acts as the person who created it and carries that person's permissions.
Let a User Manage Their Own Tokens
- Go to Settings > Users.
- Open the user.
- Enable Can manage API tokens.
The setting sits beside Can export data. Account admins have it by default.
Rate Limits
API tokens allow 10 requests per second per user, shared across all of that user's tokens. Every successful response includes headers reporting how much of your budget remains, so you can pace your requests.
Going over the limit returns an HTTP 429 with the body {"error": "Rate limit exceeded"}. That response doesn't carry the rate limit headers, so read your remaining budget from a recent successful response, then pause briefly and retry.
Troubleshooting
Error
What it means
401 — invalid or expired API token
The token is unknown, revoked, or expired. Check its status in your profile, or create a new one.
403 — this API token is read only
You used a Read only token for a write. Create a Read and write token; the access level can't be edited.
403 — API access is disabled for this user
Your API access has been switched off. Ask your account admin.
403 — you need permission to manage API tokens
Ask your admin to enable Can manage API tokens, or use the Request access button.
406 — API access is disabled
Your account hasn't enabled API access. An admin can turn it on under Settings > API.
406 — please use our API namespace
The request went to a non-API URL. Check your base URL.
422 — at most 20 active API tokens
You're at the limit. Revoke one and try again.
429 — rate limit exceeded
You went over 10 requests per second. Pause and retry.
Already Using an API Key or JWT?
Your existing API key works unchanged, and integrations using JWT are untouched — there's no forced migration and no deadline. Tokens are the recommended choice for anything new you build. See the API overview for how the three credential types compare.
Need help? Contact support at customercare@pipelinecrm.com.