Authentication
Send your token in a header. Personal tokens and service tokens.
Send your token in one of two headers. Both work on every endpoint.
| Header | Value | Used by |
|---|---|---|
Authorization | Bearer ic_... | curl, the OpenAI SDK |
x-api-key | ic_... | The Anthropic SDK |
A missing, malformed, unknown or revoked token gets 401. A token stops
working when an admin revokes it or disables its user.
Get a token
Ask an admin for a token. Admins create tokens in the dashboard under
Gebruikers, then your user, then Token. The token is shown once and
looks like ic_ followed by 43 characters.
Token types
| Personal token | Service token | |
|---|---|---|
| For | Your own experiments and coding tools | Scripts, cron jobs, n8n and other unattended jobs |
| Created by | An admin, as Persoonlijk | An admin, as Service, with a label |
| Limits | None | Requests per minute and tokens per day, set per token |
| Usage shows up under | You | You, and the token's label |
Every token belongs to a person. The owner of a service token stays accountable for what it does.
Keep tokens out of repositories
Store tokens in the secret store of the tool that runs the job, never in a repository.
See Rate limits for how service token limits count.