What is an API token?
An API token is a secret string that authenticates requests to an API. Learn how tokens work, keys vs tokens, and generate a random token free.
An API token (or API key) is a secret string you send with each request to prove your app is allowed to use an API. It replaces logging in with a username and password on every call, and it can be scoped and revoked independently.
How tokens authenticate requests
You include the token in a request — usually an Authorization: Bearer <token> header. The API looks it up, checks it is active and has the right permissions, and serves the request. Because it is a bearer credential, anyone who has the token can use it, so it must be kept secret.
Keys vs tokens
The terms overlap. An API key is typically a long-lived static secret you generate in a dashboard. A token often refers to a credential with a lifetime or scope (like an OAuth access token or a JWT). Both are secrets sent to authenticate — treat them the same way: never commit them, rotate them, and scope them narrowly.
Generating strong tokens
A good token is long and random so it cannot be guessed. Our token generator produces high-entropy strings suitable for API keys, webhook secrets, and session identifiers.
Try it now — free, no signup
Use the token generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.