---
title: "API"
description: "Create, scope and revoke CubePath API tokens, authenticate your requests, and the headers write requests need."
category: "Settings"
language: en
source: https://cubepath.com/docs/products/settings/api-tokens
updated: 2026-10-28
---

# API

Manage tokens and explore endpoints from the **API** page in [my.cubepath.com](https://my.cubepath.com).

## Create a token

Open **Organization → Tokens** and click **Create Token**:

- **Token Name** — a label to identify the token (e.g. `Production Server`).
- **Permissions** — leave **Full access** on, or turn it off and pick individual scopes.
- **Allowed IPs** (optional) — comma-separated IPs or CIDR ranges that may use the token. Leave empty to allow any IP.

> Warning: The token is shown **only once**, right after creation. Copy it immediately — you won't be able to see it again. If you lose it, delete the token and create a new one.

### Scope it down

Full access is convenient and rarely what a token needs. Two settings make a leaked token much less useful to whoever finds it:

- **Individual scopes.** A monitoring script needs read scopes and nothing else. A token that can only read can't delete a cluster.
- **Allowed IPs.** Pinning a token to the server that uses it means a copy taken from a config file is useless anywhere else.

![Create API Token dialog with per-product read and write scopes](https://cdn.cubepath.com/img/docs/products/de9dc0b3-cfb2-4c29-afc1-e00d31b41198.png)

Create one token per consumer rather than sharing one, so revoking a compromised token affects one thing rather than everything.

## Authenticate

Send your token with every request using either header:

```bash
curl https://api.cubepath.com/projects/ \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

You can use `X-API-Key: YOUR_API_TOKEN` instead of the `Authorization` header.

> Note: Write requests (`POST`, `PUT`, `DELETE`) also require the header `X-Requested-With: XMLHttpRequest`. Send JSON bodies with `Content-Type: application/json`.

That extra header on writes catches people out — a request that reads fine but fails only on writes is almost always missing it.

## Base URL

All endpoints live under:

```
https://api.cubepath.com
```

## Revoke a token

Go back to **Organization → Tokens** and **Delete** any token to revoke its access **immediately**.

Rotate a token by creating the replacement first, switching the consumer over, then deleting the old one — that way there's no window where the integration can't authenticate.

> Tip: Token use shows up in [Activity](/docs/products/settings/account-activity) with **Auth Method** set to the API key. Reviewing that column is how you find tokens still being used by something you'd forgotten about.

## Agents and MCP

To let an AI agent operate your infrastructure, the [MCP server](/docs/products/settings/mcp-server) is usually a better fit than handing over a raw token — it has its own authorization flow, per-organization consent and permission checks on every request. Tokens remain the right answer for scripts, CI and anywhere there's no browser to complete a login.