Get an access token
Open Access tokens in your account settings and create a token with a recognizable name. The complete value is shown once, so store it securely before closing the confirmation.
Authorize a request
Send the token with every protected request using the authorization header shown in the technical reference below.
Keep the token private
A token has the same access to BARFLAB data as the account that created it. Do not put it in client-side code or logs. Revoke it in account settings if it is exposed or no longer needed.
API tokens and MCP OAuth
An account access token is for direct API requests and stays active until you revoke it. MCP uses a separate, scoped OAuth token after you approve a connection. Its access token expires after 15 minutes and a supported refresh token lasts 30 days. MCP access cannot exceed the permissions you approved.
When access is denied
An unauthorized response means that the request has no valid token. A forbidden response means that the token is valid but the action is outside its permissions, ownership, or account limits.