Skip to main content
Send the access token in the api_access_token header. The same header name is used for user tokens, agent bot tokens, and platform app tokens. The token type decides which routes you can call.
A missing or unknown token returns 401.

​
User access token

A user access token calls the Application API with that user’s permissions. Each user has one access token. It is returned on the user profile:
The response includes access_token. You can also copy the token from the profile page in the portal. POST /api/v1/profile/reset_access_token rotates it and invalidates the previous value. Account routes also need the account id:

​
Agent bot token

An agent bot has its own access token. Use it for bot integrations. The token can call a limited set of Application API routes, including conversation status, messages, assignments, contact search, and knowledge base search. Other Application API routes return 401.

​
Platform app token

A platform app token calls the Platform API: accounts, account users, users, and agent bots. Create the platform app in super admin, then send its access token:
A user access token cannot call these routes.

​
OAuth 2.0

For third-party apps and MCP clients, prefer OAuth 2.0. Account admins register clients under Settings → Integrations → OAuth Applications. See OAuth clients for authorization code, client credentials, scopes, and discovery endpoints. Send the issued JWT as a bearer token:
Supported scopes: profile (default), accounts, read, write. Access tokens expire after 2 hours; use refresh tokens to renew them.

​
Client API

The Client API does not use api_access_token. Identify the inbox in the path with the inbox identifier from the API channel settings.
Contact and conversation routes add the contact source id and the conversation display id to that path.