API tokens & usage
This page explains how API tokens work in Promptdoo, how to rotate/revoke them, and how usage/credits are tracked.
Overview
API tokens are used for:
- browser extension access
- external integrations (agent apps, scripts, servers)
- calling APIs like MCP
Treat tokens like passwords.
Create a token
1. Go to
/user/api-settings.
2. Create a new token.
3. Copy it immediately.
Important:
- A token is shown only once.
Scoping (current behavior)
If your installation does not expose explicit scopes yet, treat tokens as full-access credentials.
Best practice:
- use one token per app
- revoke tokens you no longer need
Rotate a token
Rotation means:
1. create a new token
2. update your app configuration
3. revoke the old token
Revoke a token
Revocation immediately invalidates the token.
Usage & credits
Usage is tracked per token. In the API settings UI you can view:
- usage per day
- calls per day
- credits spent per day
This is useful to:
- audit integrations
- detect leaked tokens (unexpected usage)
- forecast costs
Security checklist
- never commit tokens
- store tokens in environment variables
- avoid logging tokens
- rotate tokens after incidents