Developer

API tokens

Per-agent bearer tokens for server-side integrations. Each one is scoped to a single agent and can be revoked independently. Browser embeds use separate short-lived session tokens — never put API tokens in the widget snippet.

Issue a token

1. Open the agent in your dashboard and go to Advanced settings → API tokens.
2. Add an optional label (e.g. Production backend, Local dev) and click Create token.
3. The plaintext token appears once in a green banner — copy it now. We only store a SHA-256 hash and the display prefix (amk_live_abc12345…).

Format

Tokens look like amk_live_ followed by 24 random alphanumerics. Treat them like passwords.

Use the token

Add it as a Bearer header on every server-side request to /api/chat, /api/conversations/*, and /api/messages/feedback:

Authorization: Bearer amk_live_abc123…

The token must match the botId in your request body — cross-agent use is rejected with 401.

Revoke a token

Hit Revoke on any token row in the same panel. The next request that uses it returns 401 immediately.

Best practices

• One token per environment. Use separate tokens for production, staging, and local dev so you can rotate independently.
• Poll sync responsibly. For handoff updates, call GET /api/conversations/sync about once every 2 seconds per active session (once per second only if you need faster handoff UX). Each token is capped at 60 sync requests per minute — back off when you receive HTTP 429.
• Never commit tokens. Use environment variables, secrets managers, or vault systems.
• Rotate on suspicion. Revoke immediately if a token is ever exposed in a log, screenshot, or commit.