Developer

API tokens

Per-agent bearer tokens for server-side integrations. Each one is scoped to a single agent and can be revoked independently. Browser embeds use separate short-lived session tokens — never put API tokens in the widget snippet.

Issue a token

1. Open the agent in your dashboard, scroll to API tokens.
2. Add an optional label (e.g. Production backend, Local dev) and click Create token.
3. The plaintext token appears once in a green banner — copy it now. We only store a SHA-256 hash and the display prefix (amk_live_abc12345…).

Format

Tokens look like amk_live_ followed by 24 random alphanumerics. Treat them like passwords.

Use the token

Add it as a Bearer header on every server-side request to /api/chat, /api/conversations/*, and /api/messages/feedback:

Authorization: Bearer amk_live_abc123…

The token must match the botId in your request body — cross-agent use is rejected with 401.

Revoke a token

Hit Revoke on any token row in the same panel. The next request that uses it returns 401 immediately.

Best practices

• One token per environment. Use separate tokens for production, staging, and local dev so you can rotate independently.
• Poll sync responsibly. For handoff updates, call GET /api/conversations/sync about once every 2 seconds per active session (once per second only if you need faster handoff UX). Each token is capped at 60 sync requests per minute — back off when you receive HTTP 429.
• Never commit tokens. Use environment variables, secrets managers, or vault systems.
• Rotate on suspicion. Revoke immediately if a token is ever exposed in a log, screenshot, or commit.