API tokens
Found at API Tokens.
This is where you create and manage the keys that let a script, a service, or a tool you've built talk to Routy on your behalf — without a browser and without your password.
If what you actually want is to connect an AI assistant (Claude, Cursor, …), don't create a token here — use Settings → MCP instead, which sets one up for you with the right permissions.
Permissions
Every token carries a set of permissions — the list of things a caller holding that token is allowed to ask Routy to do. You choose them when you create the token, and the Permissions column on the list shows what each of your existing tokens carries.
Permissions are written as resource.action — reports.read means "read
reports", accounts.update means "change accounts". In the picker they're
grouped by resource, so you tick the actions you want under each heading.
Think of permissions as a record of what the token is for, not as a security wall. Narrowing a token is good practice and it's what we'll enforce against, but for now treat every token you issue as sensitive regardless of the permissions you gave it.
Full access
A token whose Permissions column reads Full access can do everything in the account — read and delete accounts, manage conversions, and create further API tokens.
You'll see this on most tokens created before this screen asked you to choose. Those tokens weren't given full access by anyone on purpose: when no choice was recorded, the platform applied the broad account-admin permission by default. The badge is telling you the truth about what that key can do today.
If a Full access token is being used for something narrow — a nightly reporting script, say — the fix is to create a replacement with just the permissions it needs, move the script over to it, and revoke the old one.
You can only grant what you hold
The picker only offers permissions you have. If you were expecting an option that isn't there, you don't hold that permission yourself — ask an account admin to create the token, or to grant you the permission first.
Create a token
- Click Generate.
- Give it a name — at least 4 characters, and unique within your account. Name it after where it will live ("Nightly revenue export"), not after yourself; the name is how you'll recognise it in this list a year from now.
- Tick the permissions it needs. Nothing is ticked to begin with — the choice is deliberately yours. Pick the fewest that will do the job.
- Click Generate.
- Copy the token now. Use Copy or Download .txt and put it wherever the script or service reads its credentials from.
The token is shown once. After you close that panel it cannot be shown again — not by us, not by support. If you lose it, delete the token and create a new one.
Tokens expire a year after they're created. The Expiring On column warns you as that date approaches.
Changing a token's permissions
You can't. There's no edit — deliberately.
A token whose permissions changed after it was handed out no longer matches whatever was agreed when it was issued, and there'd be no way to tell from the outside. So to change what a token can do: delete it and create a new one. That costs almost nothing, because it's also the moment you re-paste the new secret wherever it lives — so the key and its permissions can never drift apart.
Delete a token
Use the bin icon on the row (or Delete on the card, on a phone). Anything still calling Routy with that token starts failing, so make sure you know what's using it first — the Last Used column is the quickest way to tell whether it's live.
Deletion can take up to about 30 seconds to take effect, because tokens that have just been checked are briefly remembered. If you've deleted a token because it leaked, treat that half-minute as real and rotate anything else it could have reached.
Common questions
A call is returning 401 / "unauthorized".
Check the token hasn't expired (Expiring On) and hasn't been deleted. If it's
brand new, confirm whatever's calling is sending the token you copied — the
token contains characters like +, / and =, so a value that got truncated
or URL-mangled in transit will look right but won't work.
A call is returning 403 / "forbidden". The token is valid but is being asked to do something outside the permissions it was created with. Create a replacement with the permission it needs and swap it in.
I can't create tokens at all. Creating tokens needs account-admin permission, and API tokens must be included in your plan. If you have neither, an account admin can create the token for you.
Someone left the company — which of their tokens are live? Sort by Created By, then check Last Used. Anything still in use needs to be re-issued by whoever owns that integration now, then deleted.
When to contact support
- A token you never created appears in the list.
- A token with narrow permissions is being accepted for something well outside them.
- A deleted token still works several minutes later.