API Tokens

An API token authenticates requests to the Futrou API and Futrou CLI without a personal login — useful for CI pipelines, scripts, and third-party integrations.

• Survives its creator being removed or deleted, if workspace-owned — built for automation, not tied to a person.
• Long-lived by default — set an expiration date, or leave it unlimited until revoked.
• Use the narrowest role and project scope that does the job.
• Shown once, at creation — copy it somewhere safe, since it can’t be viewed again. Lost it? Revoke and create a new one.

Types

• Workspace — owned by a workspace, bypasses 2FA.
• User — owned by a user, enforces 2FA.
• Server — owned by a standalone Futrou Nasua server, bypasses 2FA.

Roles

API tokens use the same roles as workspace members. A user-owned token carries your own role in each workspace you belong to; a workspace-owned token is assigned one directly, and can optionally be scoped to specific projects, same as a member. See more at Roles.

Workspace API Tokens

Created by hand from Workspace Settings → API Tokens, for long-running use like CI pipelines and integrations that shouldn’t depend on any one person’s account. A third-party integration can also request one directly through OAuth2, when you authorize it for a workspace instead of for yourself.

User API Tokens

Created automatically after you log in with credentials or OAuth2 — nothing to create by hand. It acts as you:

• Enforces 2FA, if you have it enabled.
• Grants access to every workspace you’re a member of, at your own role in each.
• Can create other API tokens (see note below).
• Short-lived, rotated automatically while you stay signed in, and stops working once your account is deleted.

Server API Tokens

A standalone Futrou Nasua server issues its own tokens directly, independent of Futrou Cloud, for authenticating against that server’s API when there’s no workspace involved.

Usage

Pass a token to Futrou CLI with --api-token, or the FUTROU_API_TOKEN environment variable, instead of logging in interactively:

futrou --api-token $FUTROU_API_TOKEN serverlets list

Or send it directly to the API as a bearer token:

curl -H "Authorization: Bearer $FUTROU_API_TOKEN" https://api.futrou.com/v2/serverlets