---
title: API Tokens
description: Authenticating scripts, CI, and integrations with API tokens.
---

An API token authenticates requests to the Futrou API and Futrou CLI without a personal login — useful for CI pipelines, scripts, and third-party integrations.

- Survives its creator being removed or deleted, if workspace-owned — built for automation, not tied to a person.
- Long-lived by default — set an expiration date, or leave it unlimited until revoked.
- Use the narrowest role and project scope that does the job.
- Shown once, at creation — copy it somewhere safe, since it can't be viewed again. Lost it? Revoke and create a new one.

## Types

- **[Workspace](#workspace-api-tokens)** — owned by a workspace, bypasses 2FA.
- **[User](#user-api-tokens)** — owned by a user, enforces 2FA.
- **[Server](#server-api-tokens)** — owned by a standalone Futrou Nasua server, bypasses 2FA.

## Roles

API tokens use the same roles as workspace members. A user-owned token carries your own role in each workspace you belong to; a workspace-owned token is assigned one directly, and can optionally be scoped to specific projects, same as a member. See more at [Roles](/docs/members/#roles).

## Workspace API Tokens

Created by hand from **Workspace Settings → API Tokens**, for long-running use like CI pipelines and integrations that shouldn't depend on any one person's account. A third-party integration can also request one directly through [OAuth2](/docs/glossary/#oauth2), when you authorize it for a workspace instead of for yourself.

![Create API Token dialog with name, expiration, and role selection](/img/docs/v2/api-token-create.png)

## User API Tokens

Created automatically after you log in with credentials or [OAuth2](/docs/glossary/#oauth2) — nothing to create by hand. It acts as you:

- Enforces [2FA](/docs/settings/#two-factor-authentication-2fa), if you have it enabled.
- Grants access to every workspace you're a member of, at your own role in each.
- Can create other API tokens (see note below).
- Short-lived, rotated automatically while you stay signed in, and stops working once your account is deleted.

## Server API Tokens

A standalone [Futrou Nasua](/docs/nasua/) server issues its own tokens directly, independent of Futrou Cloud, for authenticating against that server's API when there's no workspace involved.

## Usage

Pass a token to [Futrou CLI](/docs/cli/) with `--api-token`, or the `FUTROU_API_TOKEN` environment variable, instead of logging in interactively:

```bash
futrou --api-token $FUTROU_API_TOKEN serverlets list
```

Or send it directly to the API as a bearer token:

```bash
curl -H "Authorization: Bearer $FUTROU_API_TOKEN" https://api.futrou.com/v2/serverlets
```

> **Note:** When you create a workspace-owned token by hand, you can only give it a role equal to or lower than your own in that workspace — you can't mint an Owner token if you're only a Developer. This mirrors the rule for [inviting a member](/docs/members/#roles).
>
> Workspace-owned and server-owned tokens can't create other API tokens at all, regardless of their role — only a user, acting through a user-owned token, can create one. This keeps token creation traceable to an actual person even when the resulting tokens are used unattended.
>
> A third-party app can also request a token without being created by hand — see [Apps](/docs/apps/).