> ## Documentation Index
> Fetch the complete documentation index at: https://docs-vnext.kiflo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication: Generate and Manage Access Tokens

> Generate, use, and revoke Kiflo API Access Tokens to authenticate every REST API request from your app, script, or third-party integration.

Every request to the Kiflo REST API must carry a valid **API Access Token**. Kiflo uses bearer token authentication — include your token in the `Authorization` header and Kiflo will identify which account and permissions apply to the request. You can generate as many tokens as you need (one per connected application is a good practice) and revoke any of them at any time.

## Generate an API Access Token

<Steps>
  <Step title="Open Account Settings">
    Log in to your Kiflo account. Click your name or avatar in the upper-right corner and select **Account** from the dropdown menu.
  </Step>

  <Step title="Navigate to Integration">
    In the left-hand navigation of the Account Settings page, click **Integration**.
  </Step>

  <Step title="Add a new token">
    Scroll down to the **API Access Token** section and click the **Add** button.
  </Step>

  <Step title="Name your token">
    Enter a descriptive name that identifies the application this token is for — for example, `WordPress`, `Zapier`, or `Backend API`. A clear name makes it easier to manage and revoke tokens later.
  </Step>

  <Step title="Confirm and copy">
    Click **Add** again to generate the token. Your new token appears on screen.

    Click the **Paste** button (or select and copy the token string manually) to save it to your clipboard, then store it somewhere secure such as an environment variable or secrets manager.

    <Warning>
      Kiflo does **not** store your API Access Token after it is generated. If you navigate away or close the dialog without copying it, the token is gone forever — you will need to revoke it and generate a new one.
    </Warning>
  </Step>
</Steps>

## Use the token in API requests

Pass the token as a bearer credential in the `Authorization` header of every HTTP request:

```bash theme={null}
curl -X GET "https://api.kiflo.com/partners" \
  -H "Authorization: Bearer YOUR_API_ACCESS_TOKEN" \
  -H "Content-Type: application/json"
```

In application code, set the header the same way:

```javascript theme={null}
const response = await fetch('https://api.kiflo.com/partners', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.KIFLO_API_TOKEN}`,
    'Content-Type': 'application/json',
  },
});
```

<Tip>
  Store your token in an environment variable (e.g., `KIFLO_API_TOKEN`) rather than hard-coding it in source files. This keeps credentials out of version control and makes rotation straightforward.
</Tip>

## Revoke a token

Revoking a token immediately prevents any application using it from accessing your Kiflo account. Do this whenever a token is no longer needed, if it may have been compromised, or when you rotate credentials.

<Steps>
  <Step title="Open Integration settings">
    Go to **Account → Integration** and scroll to the **API Access Token** section.
  </Step>

  <Step title="Select the token">
    Click the token you want to revoke to select it.
  </Step>

  <Step title="Revoke">
    Click the **Revoke** button, then click **Yes, I'm sure** in the confirmation dialog.
  </Step>
</Steps>

The token is invalidated immediately. Any in-flight requests using that token will start receiving authentication errors.

## Next steps

* Browse the [full API reference](https://docs-api.kiflo.com) to explore available endpoints.
* Learn when to use the [REST API vs. the JS SDK](/developers/api-overview#api-vs-js-sdk--when-to-use-each).