Create an API token for another system
Create a token with only the permissions it needs, limit it to your domains and store it safely.
The written steps below are complete. The Video script tab shows exactly what the video will cover.
An API token lets another system talk to ItzSEO: a WordPress site sending email through it, or a script exporting contacts. A token is a key to your data, so give each one the smallest set of permissions that does the job.
By the end you can
- Create a token with limited permissions
- Restrict it to allowed domains
- Revoke a token you no longer use
Screens used
Steps
- 1
Open API tokens
On: /settings/api-tokensOpen Settings and choose API tokens. Only the workspace owner can open this page.
You should see: Active tokens, or "No tokens yet".
- 2
Create a token
On: /settings/api-tokensPress Create token and name it after the system that will use it.
You should see: A form listing what the token may do.
- 3
Tick only what it needs
On: /settings/api-tokensTick the permissions required, for example list and export contacts, create or update contacts, or send transactional email. Leave the rest unticked.
You should see: Only the needed permissions are ticked.
- 4
Limit the domains
On: /settings/api-tokensAdd the domains allowed to use the token. A token with no allowed domains does not work yet.
You should see: The token shows "Allowed on:" with your domains.
- 5
Copy it once
On: /settings/api-tokensCopy the token and paste it straight into the other system's settings. Do not send it by email or chat.
You should see: The other system connects.
- 6
Revoke unused tokens
On: /settings/api-tokensPress Revoke token as soon as the system that used it is retired.
You should see: The token no longer works.
Tips
- Use one token per system, so removing one does not break the others.
- If a token may have leaked, revoke it and create a new one.
Troubleshooting
- "No allowed domains — token won't work yet"
- Add the domain of the website or system that will use the token.
- You lost the token.
- A token is shown only once. Revoke it and create a new one.
One row per shot, in the same order as the guide. Estimated length 2:09, recorded signed in as Owner. Use made-up data only. How to record
Say: Create an API token for another system. Create a token with only the permissions it needs, limit it to your domains and store it safely.
Hold until you see: Lesson title on screen for three seconds.
Say: Open Settings and choose API tokens. Only the workspace owner can open this page.
Hold until you see: Active tokens, or "No tokens yet".
Say: Press Create token and name it after the system that will use it.
Hold until you see: A form listing what the token may do.
Say: Tick the permissions required, for example list and export contacts, create or update contacts, or send transactional email. Leave the rest unticked.
Hold until you see: Only the needed permissions are ticked.
Say: Add the domains allowed to use the token. A token with no allowed domains does not work yet.
Hold until you see: The token shows "Allowed on:" with your domains.
Say: Copy the token and paste it straight into the other system's settings. Do not send it by email or chat.
Hold until you see: The other system connects.
Say: Press Revoke token as soon as the system that used it is retired.
Hold until you see: The token no longer works.
Say: That is create an API token for another system. The written steps are on this lesson's page in the ItzSEO course.
Hold until you see: End card with the lesson link.
Reference articles on this topic
Mark it complete to keep your place in the course.
Related lessons
Invite a collaborator who can work across every project and marketing tool, and choose the optional areas they can manage.
See your plan, upgrade it, buy credits and open the billing portal to change your card or download invoices.
Fill in how you appear to others, and create a page where clients can follow your agency's updates.