## API tokens

URL: https://docs.atlan.com/get-started/references/api-access

> Use long-lived API tokens for simple, backwards-compatible programmatic access to Atlan APIs

API tokens provide long-lived, backwards-compatible authentication for programmatic access to Atlan APIs. By default, a token has admin-level API privileges (excluding connection admin) and can call administrative and governance endpoints. Asset access is separate and is granted via personas assigned to the token.

## Prerequisites

- **Admin access** to create tokens.
- Personas planned for the token if it must read or modify specific connections/assets. 

 - *Without personas, a token can only access connections (and their assets) that the token itself created. With personas, the token can create/read/update/delete/search glossaries and other assets permitted by those personas.*
- **Tenant base URL** (for example, `https://<your-tenant>.atlan.com`) to construct API requests.

## Create API token

1. **Open your tenant**, and from the left menu click **Admin**.

2. Click **API access**.

3. In the upper-right, click **Generate new** and select **Generate API token**.

4. In the modal, enter a **Name**. For example:

 ```
 dbt-cloud-sync
 ```

5. Enter a **Description** to note the intended use. 

 ```
 Service account for dbt Cloud → Atlan sync
 ```

6. Set an **Expiry** if you want the token to auto invalidate after a period. 

7. Select **Personas** to grant access to specific connections and assets. 

8. Click **Save**. This generates the API token.

:::warning One-time visibility
The full token is displayed only once after creation. If you lose it, delete the token and create a new one.
:::

9. **Copy or download the token now** and store it securely (secret manager, vault, or environment variable).

## Use API token

Authenticate every HTTP request with the token as a bearer credential.

1. Set the API origin to your tenant base URL and append the endpoint path.

 ```js
 https://<your-tenant>.atlan.com
 ```

2. Add the HTTP header to every request:

 ```js
 Authorization: Bearer {token}
 ```

 For example, if the token value is `eyJhbGciOi...`, set the header as:

 ```js
 Authorization: Bearer eyJhbGciOi...
 ```

## See also

* [OAuth clients](https://docs.atlan.com/llms/platform/get-started/oauth-clients/llms.txt)
* [Getting started with the APIs](https://docs.atlan.com/llms/platform/get-started/getting-started-with-the-apis/llms.txt)
* [Atlan's Open API](https://docs.atlan.com/llms/platform/get-started/atlan-s-open-api/llms.txt)

---