> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolk.every-day.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API tokens

> Tokens that let the Laravel package, CI and scripts talk to one project.

With an API token, the Laravel package, a GitHub Action or your own scripts talk to a project, for example to push new keys and fetch translations. A token belongs to the **project**, not to a person: a pipeline keeps working when a colleague leaves. Only managers manage tokens, under **Settings › API tokens** (*Instellingen › API-tokens*).

## Creating a token

<Steps>
  <Step title="Create the token">
    Click **Create token** (*Token aanmaken*). Create one token per use, for example "GitHub Actions" and "Local development", so you can revoke one without affecting the rest.
  </Step>

  <Step title="Choose permissions">
    * **Read only** (*Alleen lezen*, `read`): fetch the project, keys, translations and exports.
    * **Read and write** (*Lezen en schrijven*, `read` and `write`): also push keys, update translations and import.
  </Step>

  <Step title="Expiry date">
    By default 12 months ahead, at most 24 months ahead. Two weeks before the expiry date, the project's managers get an email.
  </Step>

  <Step title="Copy the token">
    Tolk shows the token **once**. Put it in your `.env` or in your GitHub secrets right away. If you lose it, create a new token.
  </Step>
</Steps>

```bash .env theme={null}
TOLK_TOKEN=tolk_…
```

A token always starts with `tolk_`. This lets GitHub secret scanning and code reviews recognize a token that ends up in code by accident.

<Warning>
  Never put a token in git, a ticket or a chat. Tolk itself only stores a hash: nobody can view the token later.
</Warning>

## Overview and revoking

For each token, the table shows the permissions, when and from which IP address it was last used, and when it expires. A token that expires soon is highlighted.

Choose **Revoke** (*Intrekken*) in a token's menu to make it unusable immediately. Anyone still using it gets an error from the API.

## Good to know

* A project has at most 20 active tokens.
* A token of an archived project does not work until the project is restored. A token of a deleted project or a deleted customer never works again.
* An expired token disappears from the list after 30 days.
* Every write action with a token is recorded in the audit trail, with the token's name.

## A leaked token

<Steps>
  <Step title="Revoke">
    Revoke the token immediately.
  </Step>

  <Step title="New token">
    Create a new token with the same permissions.
  </Step>

  <Step title="Replace">
    Replace the secret in GitHub or in the `.env` of whoever used it.
  </Step>
</Steps>

How to use a token in code is described under [Authentication](/developers/authentication).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.